# Use A's staked token balance can be used to mint option token as reward for User B if the payout token equals to the stake token

OTLM pools where stake token equals payout token share one balance, so reward minting consumes users' staked principal and emergencyUnstakeAll reverts.

- Payout: Contest reward
- Severity: medium
- Program: Bond
- Credited: ctf_sec
- Disclosed: 2023-06-26
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-bond-judging/issues/83
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-bond%3AM-5
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** OTLM.sol fixed-strike liquidity mining staking contract
**Root cause:** OTLM holds staked tokens and payout tokens in the same contract balance without separate accounting; when stakeToken == payoutToken, _claimEpochRewards mints option tokens using payout tokens that are actually users' staked principal.
**Steps:**
1. Deploy OTLM with stakeToken == payoutToken (e.g. USDC).
2. User A stakes 100 USDC; User B stakes 100 USDC; contract holds 200.
3. Time passes; B accrues 10 units of reward.
4. B calls claimRewards; `payoutToken.approve(optionTeller, 10)` then `optionTeller.create(optionToken, 10)` consumes 10 USDC of pooled stake, leaving 190.
5. A and B both call emergencyUnstakeAll; the second call reverts for insufficient balance, locking principal.
**How found:** Code reading of OTLM stake/claim flow: noticed stakedToken.safeTransferFrom deposits into the same contract address that _claimEpochRewards later spends payoutToken from, and reasoned that identical stake/payout tokens collide.
**Exploitation:** No attacker profit path; a user claiming accrued rewards drains the shared balance that backs other users' stakes, so later unstakers cannot withdraw principal.
**Insight:** In staking/reward contracts, check whether staked principal and reward payout tokens share one contract balance; if stakeToken can equal payoutToken, reward claims silently spend user principal and break emergency-withdraw invariants.