# function withdrawETH from GiantMevAndFeesPool can steal most of eth because of idleETH is reduced before burning token

GiantMevAndFeesPool.withdrawETH decrements idleETH before burning lpTokenETH, inflating accumulatedETHPerLPShare and letting an attacker drain ~2 ETH from the pool.

- Payout: Contest reward
- Severity: high
- Program: Stakehouse Protocol
- Credited: ronnyx2017
- Disclosed: 2023-01-20
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/129
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** GiantMevAndFeesPool / GiantPoolBase withdrawETH and SyndicateRewardsProcessor reward accounting
**Root cause:** withdrawETH reduces idleETH before burning lpTokenETH; the burn triggers beforeTokenTransfer -> _updateAccumulatedETHPerLP, and totalRewardsReceived() = balance + totalClaimed - idleETH is inflated by the premature idleETH decrement, minting accumulatedETHPerLPShare out of thin air.
**Steps:**
1. Deploy GiantMevAndFeesPool; user1 deposits 4 ETH via depositETH.
2. Attacker (user2) deposits 4 ETH via depositETH.
3. Attacker calls withdrawETH(4 ether), which decrements idleETH before burning lpTokenETH.
4. Burn triggers beforeTokenTransfer -> _updateAccumulatedETHPerLP; totalRewardsReceived inflated, accumulatedETHPerLPShare jumps.
5. Attacker receives inflated ETH reward on withdrawal; run `forge test --match-test testDWUpdateRate2 -vvv` to observe attacker ending with 6 ETH while pool retains 2 ETH.
**How found:** Code reading of withdrawETH ordering vs. the totalRewardsReceived override and the beforeTokenTransfer reward-update hook; noticed idleETH is reduced before the burn that triggers reward accrual.
**Exploitation:** Attacker deposits then immediately withdraws; the ordering bug credits phantom rewards during the burn hook, so the attacker withdraws more ETH than deposited, siphoning pool funds (PoC shows 2 ETH stolen from a 8 ETH pool).
**Insight:** When a reward accumulator derives 'received' from balance minus an idle/reserved counter, check every path that mutates the counter relative to token burns/mints that trigger the accumulator update; ordering of state decrements vs. hook-triggering burns can mint phantom shares.