# Yield can be unfairly divided because of MEV/Just-in-time stablecoin deposits

Just-in-time stablecoin deposits via MEV/flashbots bundle before distributeYield capture disproportionate yield share, then withdraw immediately after.

- Payout: Contest reward
- Severity: medium
- Program: Sturdy
- Credited: mtz
- Disclosed: 2022-06-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-sturdy-findings/issues/61
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-sturdy%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:reward-distribution

**Target:** YieldManager.sol distributeYield yield distribution
**Root cause:** Yield is distributed based on current stablecoin balance proportion at distribution time, with no snapshot or time-weighting, so a deposit made just before distributeYield receives yield proportional to its size.
**Steps:**
1. Watch mempool for admin call to `distributeYield` on YieldManager.sol#L118.
2. Build a flashbots bundle ordering: (i) attacker deposits large stablecoin amount (ideally lowest-volume stablecoin) via LendingPool, (ii) admin `distributeYield` executes, (iii) attacker withdraws deposit.
3. Attacker's deposit receives large share of yield per LendingPool.sol#L182 balance-proportional distribution; withdraw immediately after.
**How found:** Reading YieldManager yield distribution logic and LendingPool.sol#L182, noting yield is split by current asset balance proportion rather than time-weighted deposits, making it front-runnable.
**Exploitation:** Attacker front-runs distributeYield with a large stablecoin deposit (own capital or flash-borrowed from Sturdy itself), captures yield proportional to inflated balance, then withdraws in the same bundle; capital never borrowed so cost is near zero.
**Insight:** When reward/yield distribution reads instantaneous balances, check whether a deposit-withdraw sandwich around the distribution tx (flashbots bundle) captures unearned share; verify the distribution formula in the downstream pool, not just the manager.