# When rolling over, user will lose his winnings from previous epoch

Carousel.mintRollovers burns a user's full epoch shares but only remints the original deposit amount, silently destroying their winnings on rollover.

- Payout: Contest reward
- Severity: high
- Program: Y2K
- Credited: Ace-30
- Disclosed: 2023-03-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-03-Y2K-judging/issues/163
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-Y2K%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Carousel.sol rollover queue / mintRollovers
**Root cause:** mintRollovers burns queue[index].assets shares but mints assetsToMint = queue[index].assets - relayerFee instead of entitledShares, so the profit portion of the burned shares is never reissued.
**Steps:**
1. User calls `enlistInRollover` with `_assets`, stored in `rolloverQueue[index].assets`.
2. Epoch resolves with a win; `previewWithdraw(epochId, assets)` returns `entitledShares > assets`.
3. Call `mintRollovers`: `_burn(receiver, epochId, queue[index].assets)` destroys all shares.
4. `assetsToMint = queue[index].assets - relayerFee`; `_mintShares(receiver, _epochId, assetsToMint)` remints only principal.
5. Compare with `withdraw`, which burns `_assets` but transfers `entitledShares`; rollover drops the difference.
**How found:** Code-reading comparison of the rollover path against the withdraw path: noticed withdraw burns `_assets` but pays `entitledShares`, while mintRollovers burns `_assets` and remints only `assetsToMint`, exposing the asymmetry.
**Exploitation:** Any user who wins an epoch and elects rollover permanently forfeits the winnings portion of their shares; no attacker needed, loss is silent and automatic.
**Insight:** When a protocol has two exit paths (withdraw vs rollover), diff their burn/mint accounting line by line; any path that burns the full share balance but reissues a smaller computed amount silently confiscates the delta.