# Unbounded `_unlockTime` allows the attacker to get a huge `stakedTimeBonus` and dominate the voting

Staking._stakeToken never caps _unlockTime against maxStakeBonusTime, letting an attacker set a huge unlock time to mint enormous stakedTimeBonus and dominate voting.

- Payout: Contest reward
- Severity: high
- Program: Frankendao
- Credited: WATCHPUG
- Disclosed: 2022-10-31
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-11-frankendao-judging/issues/53
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-frankendao%3AH-3
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** Staking.sol _stakeToken / stakedTimeBonus calculation
**Root cause:** _stakeToken computes stakedTimeBonus from (_unlockTime - block.timestamp) without enforcing stakingSettings.maxStakeBonusTime, so an arbitrarily large _unlockTime yields an unbounded bonus.
**Steps:**
1. Call stake with a tokenId and `_unlockTime` set to a very large value (e.g. type(uint256).max or block.timestamp + huge).
2. _stakeToken stores unlockTime and computes time = _unlockTime - block.timestamp, producing a massive time value.
3. stakedTimeBonus is set proportional to that time with no cap, granting huge voting weight.
4. Use the inflated voting power to dominate governance votes.
**How found:** Code review of _stakeToken: noticed the bonus formula uses _unlockTime - block.timestamp but no check against stakingSettings.maxStakeBonusTime, despite that setting existing.
**Exploitation:** Attacker stakes a token with an enormous _unlockTime, receiving an outsized stakedTimeBonus that translates into dominant voting weight, enabling control of governance outcomes without acquiring proportional stake.
**Insight:** When a contract defines a max* config (maxStakeBonusTime) but the bonus formula divides by it without clamping the input, check whether the input is actually bounded elsewhere; missing caps on user-supplied time/duration fields are a recurring governance-weight inflation vector.