# Frontrunning by malicious validator

Malicious validator frontruns Frax's 32 ETH depositEther with a 1 ETH deposit setting their own withdrawal credentials, capturing future withdrawals.

- Payout: Contest reward
- Severity: high
- Program: Frax Finance
- Credited: parashar
- Disclosed: 2022-11-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-frax-findings/issues/81
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-frax%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm technique:chained vuln:business-logic vuln:race-condition

**Target:** Ethereum beacon chain deposit contract / validator deposit flow
**Root cause:** Beacon chain process_deposit only increases balance for an already-registered pubkey and ignores new withdrawal_credentials; a prior 1 ETH deposit with attacker-chosen credentials fixes them permanently.
**Steps:**
1. Attacker observes pending depositEther tx for pubKey P with Frax's withdrawal_credentials W.
2. Attacker frontruns with deposit(P, W_attacker, sig_attacker, root) sending 1 ether, registering P with attacker credentials.
3. Frax's 32 ETH deposit(P, W, sig, root) lands; beacon chain sees P already registered and only adds balance, keeping W_attacker.
4. Validator activates with attacker-controlled withdrawal credentials; future withdrawals go to attacker.
**How found:** Researcher reasoned about beacon chain deposit semantics: multiple deposits to same pubkey only top up balance without updating withdrawal_credentials, so an earlier small deposit can pre-set credentials before the contract's 32 ETH deposit.
**Exploitation:** Requires attacker to control the validator signing key for pubKey P (or be the validator operator) and to win the frontrun race; attacker spends 1 ETH to lock in withdrawal credentials, then Frax's 32 ETH activates the validator and eventual withdrawals/exit proceeds route to attacker.
**Insight:** When a contract deposits into a registry keyed by an identifier (pubkey), check whether the registry's first-write-wins semantics let an attacker pre-register that identifier with attacker-controlled attributes before the legitimate deposit.