# GiantMevAndFeesPool.bringUnusedETHBackIntoGiantPool function loses the addition of the idleETH which allows attackers to steal most of eth from the Giant Pool

GiantMevAndFeesPool.bringUnusedETHBackIntoGiantPool fails to re-add returned ETH to idleETH, inflating accumulatedETHPerLPShare and letting an attacker drain ~2 ETH from the pool.

- Payout: Contest reward
- Severity: high
- Program: Stakehouse Protocol
- Credited: ronnyx2017
- Disclosed: 2023-01-20
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/173
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** GiantMevAndFeesPool / SyndicateRewardsProcessor reward accounting
**Root cause:** totalRewardsReceived() = balance + totalClaimed - idleETH; bringUnusedETHBackIntoGiantPool returns ETH to the pool but never increments idleETH, so received is overstated and unprocessed rewards are inflated.
**Steps:**
1. Deposit 4 ETH each from two users into giantFeesAndMevPool via `depositETH{value:4 ether}(4 ether)`.
2. Call `batchDepositETHForStaking` to stake 4 ETH into stakingFundsVault, decreasing idleETH.
3. Warp 31 minutes, then call `bringUnusedETHBackIntoGiantPool` with the LP tokens to burn them and return ETH to the giant pool (idleETH not incremented).
4. Call `claimRewards(attacker, stakingFundsVaults, blsKeysForVaults)` with a noop vault address to trigger `_updateAccumulatedETHPerLP`, inflating accumulatedETHPerLPShare.
5. Attacker withdraws, ending with 6 ETH vs 4 ETH deposited; pool loses 2 ETH.
**How found:** Code review of the overridden totalRewardsReceived formula and comparison against batchDepositETHForStaking (which decrements idleETH) versus bringUnusedETHBackIntoGiantPool (which does not increment it), spotting the asymmetric accounting.
**Exploitation:** Attacker deposits, stakes, burns LP tokens via bringUnusedETHBackIntoGiantPool to return ETH without updating idleETH, then claims rewards to capture the phantom accumulatedETHPerLPShare, withdrawing more ETH than deposited.
**Insight:** When a contract overrides a balance-derived accounting function with a subtraction term (idleETH), audit every path that moves the underlying asset in or out and verify the subtracted term is symmetrically updated; missing increments inflate share price.