# Staking.sol#stake() DoS by staking 1 wei for the recipient when warmUpPeriod > 0

Anyone can stake 1 wei to any recipient, resetting their warmUpInfo expiry and perpetually locking their staked funds from being claimed.

- Payout: Contest reward
- Severity: high
- Program: Yieldy
- Credited: WatchPug
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-yieldy-findings/issues/187
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Staking.sol stake() warm-up claim logic
**Root cause:** stake() accepts an arbitrary _recipient and unconditionally overwrites warmUpInfo[_recipient].expiry with epoch.number + warmUpPeriod, so any deposit resets the victim's warm-up clock.
**Steps:**
1. Ensure warmUpPeriod > 0 in Staking contract.
2. Victim stakes and gets a warmUpInfo claim with expiry = epoch.number + warmUpPeriod.
3. Attacker calls `stake(1, victim)` (1 wei, victim as _recipient).
4. warmUpInfo[victim].expiry is overwritten to epoch.number + warmUpPeriod, pushing claim further out.
5. Repeat each epoch to keep victim's funds permanently unclaimable.
**How found:** Code review of stake()'s warm-up branch noticing _recipient is caller-controlled and warmUpInfo is overwritten rather than accumulated per-depositor.
**Exploitation:** Attacker repeatedly calls stake() with 1 wei and the victim's address as recipient, resetting the victim's warm-up expiry every epoch so the claim never matures; cost is negligible gas plus 1 wei per call.
**Escalation:** Scripted repeated calls across all users create perpetual griefing at near-zero cost.
**Insight:** When a staking/vesting function lets the caller name an arbitrary beneficiary and stores per-beneficiary state keyed only by that address, check whether a third party can overwrite or reset that state to grief the beneficiary.