# vault stakers and game players share the same reward pool

Vault stakers and game players both claim the same yield from one reward pool, so simultaneous withdrawals overdraw total underlying and the last user cannot withdraw.

- Payout: Contest reward
- Severity: medium
- Program: Derby
- Credited: immeas
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/269
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AM-18
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity vuln:accounting-error vuln:business-logic

**Target:** XChainController withdrawal accounting / reward pool
**Root cause:** Game-player rewards and vault-staker yield are both backed by the same underlying provider gains, so the same profit is claimable twice; totalWithdrawalRequests can exceed getTotalUnderlyingVault.
**Steps:**
1. Alice (game player) deposits 10 DRB allocated to provider; Bob stakes 10k USDC in vault.
2. Provider gains 10%, funds become 11k.
3. Alice redeems her game rewards and Bob registers withdrawal of all shares in the same cycle.
4. totalWithdrawalRequests now exceeds getTotalUnderlyingVault at XChainController.sol#L303.
5. Later withdrawer cannot be paid due to insufficient funds.
**How found:** Simplified the multi-chain vault/provider setup to one vault/one provider and reasoned about who holds a claim on the same 10% gain, then checked the withdrawal accounting line where totalWithdrawalRequests is compared to total underlying.
**Insight:** When two user classes (stakers vs game players) draw yield from one underlying pool, model each class's claim against the same profit and test simultaneous exits in one cycle; the accounting invariant totalWithdrawalRequests <= totalUnderlying breaks.