# BringUnusedETHBackIntoGiantPool can cause stuck ether funds in Giant Pool

bringUnusedETHBackIntoGiantPool pulls ETH back into the Giant Pool but never updates idleETH, so the returned funds are permanently unwithdrawable and un-stakeable.

- Payout: Contest reward
- Severity: high
- Program: Stakehouse Protocol
- Credited: koxuan
- Disclosed: 2023-01-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/115
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** GiantMevAndFeesPool / GiantSavETHVaultPool Solidity contracts
**Root cause:** withdrawUnusedETHToGiantPool transfers ETH from the vault back to the Giant Pool but does not increment idleETH, the accounting variable that gates withdrawals and staking deposits.
**Steps:**
1. Deploy GiantMevAndFeesPool and a staking funds vault; register a BLS key with knot status INITIALS_REGISTERED.
2. Victim calls `giantFeesAndMevPool.depositETH{value: 1 ether}(1 ether)` then `batchDepositETHForStaking(...)` to stake 1 ether.
3. Warp 60 minutes; call `bringUnusedETHBackIntoGiantPool(vaults, lpTokens, stakeAmounts)` — ETH returns to pool but idleETH unchanged.
4. Call `batchDepositETHForStaking(...)` again — reverts (underflow in idleETH).
5. Call `giantSavETHPool.withdrawETH(1 ether)` — reverts; funds stuck.
**How found:** Code reading of withdrawUnusedETHToGiantPool against the idleETH accounting invariant: noticed the function moves ETH but never touches the variable that tracks available ETH.
**Exploitation:** No attacker profit path; the flaw is an accounting omission that permanently locks ETH returned to the Giant Pool, blocking all subsequent deposits and withdrawals that depend on idleETH.
**Insight:** When a contract moves ETH between pools, audit every accounting variable that gates future withdrawals/deposits — a transfer without a matching counter update silently bricks funds.