# A stake that has just been locked gets full reward multiplier

Union Finance Comptroller grants full locked-stake reward multiplier to a stake locked and unlocked in the same tx, letting a staker farm rewards risk-free.

- Payout: Contest reward
- Severity: medium
- Program: Union Finance
- Credited: Bahurum
- Disclosed: 2022-11-04
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-union-finance-judging/issues/142
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-union-finance%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Comptroller.getRewardsMultiplier / staking rewards
**Root cause:** getRewardsMultiplier only checks whether a stake is currently locked, not how long it has been locked, so a lock created moments ago qualifies for the full multiplier.
**Steps:**
1. Staker stakes tokens and waits.
2. Staker vouches for a controlled member (bribe/own account).
3. Member borrows against the trust.
4. Staker calls `Comptroller.withdrawRewards` while the stake is locked, receiving the full locked multiplier.
5. Member repays the loan in the same tx so no interest is paid.
**How found:** Reviewer read getRewardsMultiplier and noticed it only reads current lockedStake/frozen state, not lock age, then wrote a PoC test showing the multiplier exceeds an honest staker's immediately after locking.
**Exploitation:** In a single transaction the staker vouches for a controlled borrower, the borrower borrows, the staker withdraws rewards at the full locked multiplier, and the borrower repays — no capital at risk, no interest paid, rewards diluted from honest stakers.
**Insight:** When a reward multiplier keys off a 'locked' flag, check whether lock duration/age is part of the accounting — a same-block lock/unlock can capture the boosted rate.