# Users are susceptible to back-running when depositing ETH to TridenRouter

TridentRouter leaves excess ETH in the contract when bento.toAmount shifts between quote and execution, letting any back-runner call refundETH to steal the remainder.

- Payout: Audit contest
- Severity: medium
- Program: Sushi
- Found by: broccoli
- Disclosed: 2021-11-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-findings/issues/179
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident%3AM-10
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:business-logic

**Target:** TridentRouter ETH deposit functions (_depositToBentoBox / _depositFromUserToBentoBox)
**Root cause:** Users must precompute and send the ETH amount matching bento.toAmount, but that elastic-derived rate can change before execution, leaving surplus ETH stranded in the router where anyone can claim it via refundETH.
**Steps:**
1. User computes `bento.toAmount(wETH, 10, true) = 15` and sends 15 ETH calling `exactInputSingleWithNativeToken` with `params.amountIn = 10`.
2. Before execution, someone calls `harvest` on bento, updating wETH elastic so `toAmount(wETH, 10, true)` becomes 14.
3. Only 14 ETH is deposited to the pool; 1 ETH remains in the router.
4. Attacker back-runs and calls `refundETH` to sweep the leftover 1 ETH.
**How found:** Code review of the ETH deposit path noticing the input param is not the actual deposit amount and that surplus ETH is left claimable in the router.
**Exploitation:** Attacker monitors pending router deposits, triggers or waits for a bento rate change (e.g. harvest) so the user's sent ETH exceeds the required amount, then back-runs with refundETH to claim the stranded surplus.
**Insight:** In routers that accept native ETH, check whether surplus from rate/quote drift between submission and execution is refunded to the sender or left in the contract; any sweep/refund function becomes a back-run profit primitive.