# Flashloan `TEL` tokens to stake and exit in the same block can fake a huge amount of stake with minimal material cost

Checkpoints.getAtBlock returns checkpoint #0 when two checkpoints exist in one block, letting a flashloan stake-and-exit fake stake for rewards and dodge slashing.

- Payout: Contest reward
- Severity: medium
- Program: Telcoin
- Credited: WATCHPUG
- Disclosed: 2022-11-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-11-telcoin-judging/issues/83
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-telcoin%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:flash-loan vuln:reward-distribution

**Target:** StakingModule / Checkpoints.getAtBlock (Solidity staking contract)
**Root cause:** Checkpoints#getAtBlock returns the value of the first checkpoint (#0) when two checkpoints are written in the same block, so a stake and exit in one block leaves a stale inflated balance readable at that block.
**Steps:**
1. Flashloan a large amount of TEL tokens.
2. Call stake() to write checkpoint #0 with the inflated balance.
3. Call exit() in the same block to write checkpoint #1.
4. getAtBlock() for that block returns checkpoint #0 (the inflated stake), faking a huge stake with minimal material cost.
**How found:** Code review of Checkpoints#getAtBlock semantics: noticed that with two checkpoints in the same block (#0 and #1) the lookup returns #0, then reasoned a same-block stake/exit via flashloan creates exactly that state.
**Exploitation:** Attacker flashloans TEL, stakes and exits within one block; getAtBlock/balanceOfAt then reports the inflated first checkpoint, letting them claim a high percentage of rewards and avoid slashing, then repays the flashloan.
**Insight:** When auditing checkpoint/balance-snapshot logic, check how same-block multiple writes are resolved; a lookup that returns the earliest checkpoint in a block lets a flashloan stake-and-exit inflate historical balance reads.