# The first AMM Staker will have control over how the shares are calculated.

First AMM gauge staker stakes 1 wei so totalStaked starts at zero, skewing share accounting and letting them frontrun later stakers to capture disproportionate rewards.

- Payout: Contest reward
- Severity: medium
- Program: Backd
- Credited: 0xNineDec
- Disclosed: 2022-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-backd-findings/issues/100
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-backd%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:share-inflation

**Target:** AmmGauge staking/rewards contract (Solidity)
**Root cause:** When totalStaked is zero, the checkpoint loop that accrues per-user staked integral is skipped, so the first staker's 1 wei deposit leaves the integral uninitialized and subsequent share math misattributes rewards.
**Steps:**
1. Alice (first staker) calls `stake(1)` on AmmGauge, leaving totalStaked effectively at 1 wei with zero accrued integral.
2. Bob submits `stake(10e18)`; Alice frontruns with `stake(10e18)` so her txn mines first.
3. Bob's stake mines; pool checkpoint later accrues integral only against Alice's larger position.
4. Repeat: Alice frontruns Bob's second `stake(10e18)`; after next `poolCheckpoint()` Alice holds ~2x Bob's shares (172.8 vs 86.4) despite equal deposits.
**How found:** Researcher read AmmGauge stake/checkpoint logic, noticed totalStaked starts at zero and the integral update loop is skipped on first deposit, then built a Hardhat simulation comparing attacked vs non-attacked share tables.
**Exploitation:** Attacker monitors mempool, becomes first depositor with 1 wei, then frontruns every large stake with an equal-or-larger stake so the zero-initialized integral accrues rewards to them; value leaks from later stakers as inflated reward shares.
**Insight:** In staking/reward gauges using cumulative integral accounting, test the zero-to-nonzero transition of totalStaked: a 1 wei first deposit can leave the global integral uninitialized and let the first staker capture accrual meant for later depositors.