# Renewal resets period instead of extending

Renewal or top-up paths that set start time to now rather than prior expiry

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2024-07-15. Updated 2026-10-23._

## How it works
A renewal or top-up is supposed to extend an existing period: the new period should begin where the old one ended (or at the prior expiry), so the user pays for and receives only the added time. The bug is that the renewal path anchors the new period's start to `block.timestamp` (now) instead of the prior expiry. Any gap between the old expiry and the renewal moment becomes free, uncharged coverage, or the start timestamp is shifted forward so eligibility moves into the future. The broken assumption: that "now" equals "where the last period ended."

## Where it shows up
- Renewal/extend/top-up functions that assign a start or creation timestamp from `block.timestamp`.
- Grace-period logic that validates the old expiry but then writes a fresh start.
- Extension code that adds a duration to the start timestamp rather than to the expiry.
- Top-up paths that recompute a weighted duration but keep a multiplier tied to the original duration.
- Inconsistent multiplier/rate assignment between `renew` and `addToPosition`-style functions.

## How to review
Check the invariant: after renewal, `newStart == oldExpiry` (or the period is contiguous), and the user is charged for the full added duration including any grace gap. For extensions, the start timestamp must stay fixed and only the expiry moves forward. For weighted-average recalculations, every dependent value (multiplier, rate) must be derived from the new duration, not the initial one. Compare renewal and top-up paths for identical assignment logic.

## Variants seen
- Renewal restarts coverage at `block.timestamp` instead of prior expiry, giving free grace-period coverage [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-1.md).
- Extension adds duration to the start/creation timestamp, pushing eligibility into the future [E3](https://bugbountylibrary.com/r/c4%3A2021-11-fairside%3AM-02.md).
- Top-up recomputes lock duration as a weighted average but assigns the multiplier from the initial duration, retaining a high multiplier for a shorter lock [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-2.md).

## Impact and severity
Free coverage or uncharged premium [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-1.md), users locked out of membership features [E3](https://bugbountylibrary.com/r/c4%3A2021-11-fairside%3AM-02.md), and multiplier arbitrage that over-rewards users [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-2.md). Severity is medium-to-high: direct value leakage and broken accounting, worse where grace windows or multipliers amplify the gap.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-2.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-1.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-11-fairside%3AM-02.md