# UNION rewards issuance can be maximized without providing credit

Union rewards multiplier is computed only at withdrawRewards time, letting a staker self-lend for one block to claim 2x rewards for years of stake.

- Payout: Contest reward
- Severity: high
- Program: Union Finance
- Credited: hyh
- Disclosed: 2022-11-04
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-union-finance-judging/issues/49
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-union-finance%3AH-6
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Comptroller/UserManager reward accounting
**Root cause:** Reward multiplier is derived from current account state (isMember, locked stake) only when withdrawRewards is called, not at the time state changes, so historical blocks are rewarded at the current multiplier.
**Steps:**
1. Stake UNION and wait N blocks/years without calling withdrawRewards.
2. Register as member via a second account and self-borrow the full stake to lock it.
3. Immediately call `withdrawRewards()` in the same block.
4. `_getRewardsMultiplier` returns 2x because isMember and locked stake are now set, applied to the entire pastBlocks period.
**How found:** Code reading of Comptroller reward accounting: noticed _calculateRewardsByBlocks is only invoked from stake/unstake/withdrawRewards, and inflationIndex uses current state, so past blocks are retroactively rewarded at the new multiplier.
**Exploitation:** Attacker stakes, idles, then in one block becomes a member and self-lends to lock stake, then calls withdrawRewards to collect rewards for the whole idle period at the 2x member multiplier, paying negligible interest and bearing no credit risk.
**Insight:** When a reward/interest formula depends on mutable account state, check whether the state snapshot is taken at accrual time or only at claim time; lazy accrual lets users backdate favorable state.