# Reentrancy vulnerability in GiantMevAndFeesPool.withdrawETH

GiantMevAndFeesPool.withdrawETH burns LP tokens and sends ETH before decrementing idleETH, letting a reentrant claimRewards inflate accumulatedETHPerLPShare and overpay rewards.

- Payout: Contest reward
- Severity: high
- Program: Stakehouse Protocol
- Credited: cccz
- Disclosed: 2023-01-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/244
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-16
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reentrancy vuln:reward-distribution

**Target:** GiantMevAndFeesPool / GiantPoolBase withdrawETH and claimRewards
**Root cause:** withdrawETH decrements idleETH after burning LP tokens and after the ETH transfer callback, and claimRewards lacks nonReentrant, so reentering claimRewards during the ETH send sees stale idleETH and inflated accumulatedETHPerLPShare.
**Steps:**
1. Call `withdrawETH(_amount)` with `_amount >= MIN_STAKING_AMOUNT` and LP balance >= _amount.
2. In the ETH-receiving fallback, reenter `claimRewards()` before idleETH is decremented.
3. claimRewards computes rewards against un-decremented idleETH, raising totalRewardsReceived and accumulatedETHPerLPShare.
4. Receive excess ETH rewards; repeat to drain idleETH.
**How found:** Code reading of withdrawETH ordering: burn then external ETH call before idleETH decrement, combined with absence of nonReentrant on claimRewards.
**Exploitation:** Attacker triggers withdrawETH, and in the fallback reenters claimRewards while idleETH is still high, causing reward-per-share to be computed on inflated idleETH and paying out more ETH than owed.
**Insight:** When a guarded function makes an external ETH call, check every sibling function that reads the same accounting state (idleETH, reward-per-share) for missing nonReentrant; the reentry target need not be the guarded function itself.