# Rewards can be stolen

NFTXInventoryStaking pays rewards in one chunk on receiveRewards; attacker frontruns with deposit, earns pro-rata rewards, withdraws after 2s lock.

- Payout: Audit contest
- Severity: medium
- Program: NFTX
- Found by: cmichel
- Disclosed: 2022-03-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-nftx-findings/issues/136
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-nftx%3AM-07
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:race-window vuln:business-logic vuln:reward-distribution

**Target:** NFTXInventoryStaking contract (receiveRewards/deposit)
**Root cause:** Rewards are distributed as a single lump sum to whoever is staked at the moment receiveRewards is called, rather than accrued over time.
**Steps:**
1. Watch mempool for owner's `receiveRewards` tx
2. Frontrun it with `deposit` to enter the staking contract
3. receiveRewards executes, attacker receives pro-rata share of rewards
4. Wait `DEFAULT_LOCKTIME` (2 seconds)
5. Withdraw deposit plus rewards for profit
**How found:** Observed that receiveRewards distributes a lump sum to current stakers and that deposit locktime is only 2 seconds, enabling mempool frontrunning.
**Exploitation:** Attacker needs only to be staked for the 2-second lock window around reward distribution; capital is briefly deposited, rewards captured pro-rata, then withdrawn.
**Insight:** When rewards are paid as a lump sum to current stakers, check the minimum stake locktime — if it's shorter than the reward cadence, frontrunning the distribution is profitable.