# Dishonest Stakers Can Siphon Rewards From xToken Holders Through The deposit Function In NFTXInventoryStaking

NFTXInventoryStaking deposit timelock of 2s lets a funded attacker frontrun reward distribution, stake, then exit next block to siphon xToken holders' rewards.

- Payout: Audit contest
- Severity: medium
- Program: NFTX
- Found by: leastwood
- Disclosed: 2022-03-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-nftx-findings/issues/57
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-nftx%3AM-13
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:reward-distribution

**Target:** NFTXInventoryStaking / XTokenUpgradeable deposit and NFTXSimpleFeeDistributor.distribute
**Root cause:** Deposits are only timelocked 2 seconds, so an attacker can stake just before a reward distribution and withdraw the next block; distribute() also lacks access control.
**Steps:**
1. Observe mempool for `distribute` call in `NFTXSimpleFeeDistributor` (no access control, attacker can also trigger it)
2. Frontrun by calling `deposit` in `NFTXInventoryStaking` with large vault token amount, minting shares
3. Reward distribution adds base tokens to `XTokenUpgradeable`, inflating share value
4. Withdraw in next block (~13s > 2s timelock), redeeming shares for principal plus proportional reward share
**How found:** Code review of deposit timelock (2s) versus average block time (~13s), noting distribute() has no access control, enabling frontrun of reward distribution.
**Exploitation:** Attacker needs large capital (no flash liquidity assumed); stakes vault tokens before a reward distribution, captures majority share of the 200 base token reward, then exits next block redeeming 1000 shares for 1100 base tokens, netting 100 base tokens.
**Insight:** When a staking/reward contract uses a timelock shorter than block time, check whether reward distribution is permissionless and mempool-visible; that combination enables just-in-time stake/exit reward sniping.