# Incorrect accounting in SyndicateRewardsProcessor results in any LP token holder being able to steal other LP tokens holder's ETH from the fees and MEV vault

SyndicateRewardsProcessor overwrote claimed amount instead of accumulating it, letting any LP holder repeatedly claim ETH rewards and drain the fees/MEV vault.

- Payout: Contest reward
- Severity: high
- Program: Stakehouse Protocol
- Credited: c7e7eff
- Disclosed: 2023-01-20
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/147
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SyndicateRewardsProcessor / StakingFundsVault claimRewards
**Root cause:** In _distributeETHRewardsToUserForToken, claimed[_user][_token] is set to `due` instead of incremented by `due`, so prior claims are forgotten and the same accumulated rewards can be re-claimed repeatedly.
**Steps:**
1. Deploy StakingFundsVault with two LPs depositing maxStakingAmountPerValidator/2 each for a BLS key
2. Deposit 24 ETH into savETHVault and stakeAndMintDerivativesSingleKey
3. vm.deal 1.2 ETH to vault; each LP previewAccumulatedETH = 0.6 ETH
4. accountOne calls `vault.claimRewards(accountOne, [blsPubKeyFour])` -> receives 0.6 ETH, claimed set to 0.6 ETH
5. Add another 1.2 ETH to vault; accountOne calls claimRewards repeatedly -> each call pays 0.6 ETH again because claimed stays 0.6 ETH
6. Repeat until vault balance is 0; accountTwo's claim then reverts 'Failed to transfer'
**How found:** Manual code review of the reward accounting: noticed `claimed[_user][_token] = due` instead of `+= due`, then wrote a forge test with two LPs and repeated claimRewards calls to confirm the vault drains.
**Exploitation:** Any LP token holder calls claimRewards repeatedly after each reward accrual; because claimed is overwritten rather than accumulated, each call re-pays the full due amount, draining the fees and MEV vault and blocking other LPs from claiming.
**Insight:** In reward-accounting contracts, verify that the per-user claimed/checkpoint variable is monotonically accumulated (`+=`) rather than assigned; a single `=` in a claim function lets the same accrued rewards be re-claimed every call.