# secondary markets are problematic with how `lockCapital` works

Anyone can call assessState to trigger lockCapital snapshot; attacker flash-loans sTokens from a secondary market to capture the unlock share.

- Payout: Contest reward
- Severity: medium
- Program: Carapace
- Credited: charlesjhongc
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-carapace-judging/issues/147
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** ProtectionPool / DefaultStateManager lockCapital snapshot logic
**Root cause:** assessState is permissionless and lockCapital snapshots sToken balances at that instant; claimable unlocked capital is proportional to balance at snapshot, so whoever holds sTokens at lock time captures the payout.
**Steps:**
1. Predict timestamp when pool transitions to Late.
2. Flash-borrow sTokens from a Uniswap-style secondary market.
3. Call `assessState` (permissionless) to move pool Active/LateWithinGracePeriod -> Late, triggering `lockCapital` and `_snapshot()`.
4. Hold sTokens through the snapshot transaction.
5. If borrower pays and pool returns Active, later claim unlocked capital via `_claimableUnlockedCapital` proportional to snapshot balance.
6. Repay flash loan, keep the unlocked capital share minus fee.
**How found:** Reading lockCapital's `_snapshot()` and the claimable formula `balanceOfAt/totalSupplyAt`, combined with docs noting sTokens trade on secondary markets, revealed that a permissionless state transition plus flash-loanable sTokens lets an attacker capture the snapshot share.
**Exploitation:** Attacker flash-loans sTokens, calls assessState at the predictable Late transition to be the snapshot holder, then claims the proportional unlocked capital when the pool unlocks, paying only the flash-loan fee.
**Insight:** When a payout is proportional to a balance snapshot taken at a permissionless, predictable trigger, check whether that token is flash-loanable or tradeable on a secondary market — the snapshot holder can be rented.