# User can receive more rewards through a mistake in the withdrawal logic

SingleSidedLiquidityVault resets userRewardDebts to zero before computing cachedUserRewards, letting a partial withdrawer over-claim reward tokens.

- Payout: Contest reward
- Severity: high
- Program: Olympus
- Credited: joestakey
- Disclosed: 2023-03-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-olympus-judging/issues/13
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-olympus%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** SingleSidedLiquidityVault.withdraw / _withdrawUpdateRewardState
**Root cause:** userRewardDebts is set to 0 before being subtracted from rewardDebtDiff, so the cached reward delta equals the full rewardDebtDiff instead of the difference against already-claimed rewards.
**Steps:**
1. Alice deposits and gets 1e18 LP shares.
2. Alice earns 1e17 rewards and claims them (userRewardDebts = 1e17).
3. More time passes; 5e17 additional rewards accrue.
4. Alice calls withdraw(5e17, claim=false), invoking _withdrawUpdateRewardState with lpAmount_=5e17.
5. rewardDebtDiff = 5e17 * accumulatedRewardsPerShare = 3e17 > userRewardDebts 1e17.
6. Contract sets userRewardDebts=0 then adds rewardDebtDiff - 0 = 3e17 to cachedUserRewards.
7. Alice later claims cached rewards, receiving 7e17 total instead of 6e17.
**How found:** Manual review of the reward accounting in _withdrawUpdateRewardState; noticed userRewardDebts was zeroed before being used in the cachedUserRewards subtraction, producing an off-by-debt over-credit.
**Exploitation:** Attacker claims some rewards, lets more accrue, then performs a partial withdraw with claim=false so the debt reset inflates cachedUserRewards, then claims the inflated cache to extract extra reward tokens from the vault.
**Insight:** In reward-debt accounting, check the ordering of state resets versus the subtraction that computes the delta; zeroing a debt before using it in the same expression silently converts a difference into a full amount.