# Protection seller will lose unlocked capital if it fails to claim during more than one period

DefaultStateManager._calculateClaimableAmount overwrites instead of accumulating claimable unlocked capital across snapshots, so sellers who miss a claim period lose funds.

- Payout: Contest reward
- Severity: high
- Program: Carapace
- Credited: dec3ntraliz3d
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-carapace-judging/issues/142
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity vuln:accounting-error vuln:business-logic

**Target:** DefaultStateManager / ProtectionPool claimUnlockedCapital
**Root cause:** _calculateClaimableAmount assigns _claimableUnlockedCapital on each loop iteration over lockedCapitals instead of incrementing, so only the last snapshot's amount is returned.
**Steps:**
1. Pool enters locked state with snapshotId 1, then active
2. Pool enters locked state with snapshotId 2, then active
3. Seller calls `ProtectionPool.claimUnlockedCapital`
4. Only snapshotId 2 amount is paid; snapshotId 1 amount is lost
**How found:** Code review of the claim loop: noticed `_claimableUnlockedCapital` was assigned (not `+=`) inside the loop, intended to prevent double-claiming the same snapshot but also discarding prior snapshots.
**Exploitation:** Seller who fails to claim during an earlier period permanently loses that period's unlocked capital because the later claim overwrites rather than accumulates.
**Insight:** When a loop guards against double-claiming by overwriting a return variable, check whether multiple legitimate unclaimed entries can coexist; accumulation with per-snapshot claimed flags is usually the correct pattern.