# Fund lose in function bringUnusedETHBackIntoGiantPool() of GiantSavETHVaultPool ETH gets back to giant pool but the value of idleETH don't increase

GiantSavETHVaultPool.bringUnusedETHBackIntoGiantPool returns unused ETH to the pool but never increments idleETH, permanently locking those funds from withdrawal or restaking.

- Payout: Contest reward
- Severity: high
- Program: Stakehouse Protocol
- Credited: unforgiven
- Disclosed: 2023-01-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/229
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-14
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** GiantSavETHVaultPool / GiantPoolBase Solidity contracts
**Root cause:** bringUnusedETHBackIntoGiantPool burns savETH LP tokens and receives ETH back into the giant pool, but does not increment the idleETH accounting variable, so the contract's tracked idle balance diverges from its actual ETH balance.
**Steps:**
1. Giant pool starts with idleETH = 100.
2. User calls `batchDepositETHForStaking()` with 80 ETH; idleETH drops to 20 and LP tokens minted.
3. The 80 ETH sits unused in the savETH vault (not yet staked in stakehouse).
4. User calls `bringUnusedETHBackIntoGiantPool(_savETHVaults, _lpTokens, _amounts)`; vault.burnLPTokens returns 80 ETH to the giant pool, but idleETH stays 20.
5. Pool now holds 100 ETH but only 20 is accounted; the extra 80 ETH cannot be withdrawn or redeposited since deposit/withdraw logic reads idleETH.
**How found:** Code review of the giant pool accounting: noticed idleETH is adjusted on deposit/withdraw paths but the bringUnusedETHBackIntoGiantPool path only burns LP tokens and receives ETH without touching idleETH, then traced the deposit/withdraw flow to confirm idleETH gates access to the balance.
**Exploitation:** No direct theft; the returned ETH becomes permanently stranded because all deposit/withdraw paths gate on idleETH, which under-reports the real balance. Funds are effectively locked in the contract.
**Insight:** When auditing pool contracts, enumerate every code path that changes the contract's ETH/token balance and check each one updates the internal accounting variable; return/refund functions are commonly missed because they only burn shares.