# `MlumStaking::addToPosition` should assing the amount multiplier based on the new lock duration instead of initial lock duration.

MlumStaking.addToPosition keeps initial lock multiplier while recalculating lock duration, letting users retain high multiplier with shorter lock or arbitrage renewLockPosition.

- Payout: Contest reward
- Severity: medium
- Program: Magicsea
- Credited: Honour
- Disclosed: 2024-07-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-magicsea-judging/issues/138
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** MlumStaking staking contract
**Root cause:** addToPosition recalculates lockDuration as amount-weighted average but assigns lockMultiplier based on initialLockDuration, not the new duration. Also, renewLockPosition and addToPosition use inconsistent multiplier assignment logic.
**Steps:**
1. Alice calls `createPosition(1 ether, 365 days)`; lockMultiplier = 3.
2. After 365 days, Alice calls `addToPosition(1, 1 ether)`; new lockDuration = (0*1 + 1*365)/2 = 182.5 days, but lockMultiplier remains 3.
3. Alternatively, Alice creates position with 365 days, after 275 days calls `addToPosition(1, 1 wei)`; lockDuration ≈ 90 days, multiplier still 3.
4. After 30 days, Alice calls `renewLockPosition(1)`; multiplier recalculated to ≈1+90/365*2 < 3.
5. Alice calls `addToPosition(1, 1 wei)` again; multiplier resets to 3 while lockDuration stays ≈90 days.
**How found:** Code review of addToPosition and renewLockPosition revealed inconsistent multiplier assignment and edge case when remaining lock time is zero.
**Exploitation:** Users can repeatedly add minimal amounts (1 wei) to reset the multiplier to the initial high value while keeping a shorter lock duration, gaining inflated rewards or voting power without proportional lock time.
**Insight:** When a function recalculates a time-weighted average, ensure all dependent state variables (like multipliers) are updated based on the new value, not the original. Also check for inconsistencies between similar functions that update the same state.