# OperationalStaking may not possess enough CQT for the last withdrawal

OperationalStaking rounds shares/tokens down against the protocol, letting users accumulate dust shares that become withdrawable after multiplier increase, draining the last CQT and reverting final withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Covalent
- Credited: aslanbek
- Disclosed: 2023-11-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-11-covalent-judging/issues/39
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-covalent%3AM-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** OperationalStaking.sol staking contract (_tokensToShares/_sharesToTokens)
**Root cause:** _tokensToShares and _sharesToTokens both round down instead of rounding against the user, leaving dust shares that become withdrawable once totalUnlockedValue crosses REWARD_REDEEM_THRESHOLD after a multiplier increase.
**Steps:**
1. Stake an amount such that `_tokensToShares` leaves dust shares on the user's balance.
2. Unstake fully; `_sharesToTokens` rounds down, leaving residual dust shares below REWARD_REDEEM_THRESHOLD so they cannot be redeemed.
3. Wait for the multiplier to increase so totalUnlockedValue exceeds REWARD_REDEEM_THRESHOLD.
4. Redeem the now-withdrawable dust, withdrawing more than initialStake + shareOfRewards.
5. Repeat until contract CQT balance is short; last user's `transferUnstakedOut`/`redeemRewards`/`redeemCommission` reverts on insufficient balance.
**How found:** Code review of the share/token conversion math noticing both functions round down (against protocol, not user) and that the REWARD_REDEEM_THRESHOLD check blocks dust redemption until multiplier growth makes it withdrawable.
**Exploitation:** User stakes/unstakes to accumulate rounding dust, waits for multiplier increase to make dust redeemable, then withdraws excess CQT; repeated across users leaves the contract short so the final withdrawal reverts.
**Insight:** When auditing share-based staking, check rounding direction on both stake and unstake conversions and whether a minimum-redeem threshold can be bypassed by waiting for a rate/multiplier increase that inflates dust value.