# getRemainingUnstakeTime() returns 0 if user has not unstaked Low/Info · Three Sigma · Omnichain RWA tokenisation · 6th April, 2024 Finding 3S-MZ-L01 of the MetaZero Staking security review. - Protocol: https://metazero.gg/ - Report: /reports/metazero-ii - Codebase: https://github.com/0xsimao/stakingContract/tree/dffac73e838a9fbd12bed18e41b9799177bcde7f - Source: https://cdn.sanity.io/files/qoqld077/production/3e07b0c2806b62578b8031e88c59bc5dbd38de1b.pdf --- ### Description getRemainingUnstakeTime() returns 0 if the user has not initiated unstaking. ### Recommendation If staker.unstakeInitTime == 0 return unstakeTimeLock. ### Status Acknowledged --- Related findings: - [Malicious user can call `borrowing::calculateCumulativeRate()` any number of times to inflate debt rate as `lastEventTime` is not updated](https://0xsimao.com/findings/autonomint-calculate-times-inflate-debt): Autonomint