# User loses remaining rewards in GiantMevAndFeesPool when new deposits happen because _onDepositETH() set claimed[][] to max without transferring user remaining rewards

GiantMevAndFeesPool._onDepositETH resets claimed[][] to max on new deposits, silently wiping the user's already-accrued unclaimed ETH rewards.

- Payout: Contest reward
- Severity: high
- Program: Stakehouse Protocol
- Credited: unforgiven
- Disclosed: 2023-01-20
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/240
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** GiantMevAndFeesPool / GiantPoolBase depositETH reward accounting
**Root cause:** _onDepositETH() calls _setClaimedToMax() which sets claimed[user][lpTokenETH] = accumulatedETHPerLPShare * newBalance, discarding previously accrued-but-unclaimed rewards instead of paying them out first.
**Steps:**
1. user1 deposits 10 ETH when accumulatedETHPerLPShare=2; claimed=20
2. accumulatedETHPerLPShare rises to 4; user1 has 10*4-20=20 unclaimed
3. user1 calls depositETH(5); _setClaimedToMax sets claimed=15*4=60
4. user1's claimable becomes 15*4-60=0; the 20 ETH of rewards are lost
**How found:** Code reading of depositETH flow: noticed _onDepositETH runs after minting and overwrites claimed to max without first settling outstanding rewards.
**Exploitation:** Any user who deposits additional ETH after rewards have accrued forfeits their pending rewards; the value stays in the pool and is effectively redistributed to other LPs.
**Insight:** In reward-per-share accounting, any 'reset claimed to max' on deposit must first pay out accrued rewards; check ordering of mint vs. claim-settlement in deposit hooks.