# New staking positions still gets the full reward amount as with old stakings, diluting rewards for old stakers

Magicsea MLUM staking credits new positions full rewards immediately, letting a 1-second staker siphon 25% of rewards from a 1-year staker.

- Payout: Contest reward
- Severity: medium
- Program: Magicsea
- Credited: ChinmayF
- Disclosed: 2024-07-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-magicsea-judging/issues/74
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** MlumStaking.sol reward accounting
**Root cause:** Reward shares are computed from current staked amount with multiplier at harvest time, so positions created just before a distribution receive the same per-token reward as long-held positions; multiplier curve also makes 1-second locks nearly as strong as 1-year locks.
**Steps:**
1. Alice creates position with `_pool.createPosition(50 ether, 365 days)`
2. Bob creates position with `_pool.createPosition(50 ether, 1)` (1 second lock)
3. Rewards of 100 ether minted to pool
4. Both call `harvestPosition`; Bob receives 25 ether vs Alice's 75 ether
**How found:** Reviewer read the staking docs stating rewards flow to stakers and compared reward math for new vs old positions, noticing multiplier curve compresses 1-second and 1-year locks to at most 3x difference.
**Exploitation:** Attacker monitors protocol trading volume offchain, front-runs or times a reward distribution by creating a minimal-duration position, then harvests the pro-rata share and can leave the expired position accruing rewards or unstake immediately.
**Insight:** In reward-distribution staking contracts, check whether newly created positions are excluded from the current epoch's distribution; a flat multiplier curve with short lock durations lets flash-duration stakers dilute long-term stakers.