Surge — [H-03] Unstake causes all users to lose their rewards

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 55142-unstake-causes-all-users-to-lose-rewards. Standalone Foundry PoC and full write-up: 55142-unstake-causes-all-users-to-lose-rewards_exp in the evm-hack-registry mirror.

Vulnerability classes: reward-calculation · reward-theft · reward-accounting

Reproduction: self-contained Foundry PoC with only forge-std — no fork. output.txt · test/55142-…_exp.sol.

AuditVault taxonomy: lang/solidity · platform/shieldify · severity/high · genome: reward-calculation · reward-theft · reward-accounting

Key info#


Impact	HIGH — a single unstake zeroes the cycle's total reward-pool shares; all users lose rewards
Protocol	Surge — `StakingVault._unstake`
Vulnerable code	`shares = _rewardPoolShares[poolId][cycleId]` then `-= shares` (subtracts the total)
Bug class	Wrong variable — total vs personal shares
Finding	Shieldify Security — Surge · #55142
Report	Surge-Security-Review.md
Source	AuditVault
Fix	Subtract the unstaking user's personal share amount only
Compiler	`^0.8.24` (PoC)

TL;DR#

User and attacker each stake 1000 into cycle 1 (total shares = 2000).
Rewards are injected for the cycle.
Attacker unstakes; _unstake reads total pool shares and subtracts that from itself → 0.
User's claimRewardsToOwed sees total = 0 and pays nothing. Rewards wiped for everyone.

Vulnerable code#

SOLIDITY

function _unstake(address user) internal {
    uint256 shares = rewardPoolShares[poolId][cycleId]; // @> VULN: total, not user
    // FIX: uint256 shares = userShares[user][poolId];
    rewardPoolShares[poolId][cycleId] -= shares; // zeroes the cycle
}

Diagrams#

flowchart TD A["User + attacker stake 1000 each"] --> B["rewardPoolShares cycle1 = 2000"] B --> C["Attacker unstake"] C --> D["shares = total 2000"] D --> E["total -= 2000 → 0"] E --> F["User claimRewards"] F --> G{"total == 0?"} G -->|yes| H["reward = 0 for all users"]

Impact#

Any unstake permanently destroys reward accounting for the affected cycle(s); remaining stakers cannot claim their fair share.

Sources#

AuditVault #55142
Shieldify Surge Security Review
Reduced StakingVault._unstake from the finding

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 55142-unstake-causes-all-users-to-lose-rewards_exp (evm-hack-registry mirror).
AuditVault finding: 55142-unstake-causes-all-users-to-lose-rewards.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync