# Old stakers can steal deposits of new stakers in StakingFundsVault

StakingFundsVault counts new deposits as rewards before updating LP shares, letting an old staker claim and drain new stakers' ETH.

- Payout: Contest reward
- Severity: high
- Program: Stakehouse Protocol
- Credited: Jeiwan
- Disclosed: 2023-01-20
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/255
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-18
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StakingFundsVault / SyndicateRewardsProcessor reward accounting
**Root cause:** updateAccumulatedETHPerLP reads the contract's ETH balance after the new deposit is already received, so the deposit is counted as unprocessed rewards and folded into accumulatedETHPerLPShare before LP shares are minted.
**Steps:**
1. Alice deposits 4 ETH to MEV+fees vault for BLS key one via `depositETHForStaking`.
2. Validator registered, derivatives minted; totalShares = 4 ETH.
3. Bob deposits to vault for a different BLS key; vault balance now includes Bob's ETH.
4. Alice calls `claimRewards(alice2, [blsPubKeyOne])`; `_claimFundsFromSyndicateForDistribution` then `updateAccumulatedETHPerLP` treats Bob's deposit as unprocessed rewards.
5. `_distributeETHRewardsToUserForToken` pays Alice `accumulatedETHPerLPShare * balance / PRECISION` = Bob's deposit.
**How found:** Code reading of reward accounting: noticed updateAccumulatedETHPerLP is invoked after ETH is received in depositETHForStaking, so the balance check includes the just-deposited amount, and that amount is attributed to existing LP shares.
**Exploitation:** Attacker stakes minimal ETH early, waits for validator registration and derivative minting, then waits for any new staker to deposit into the vault for another key. Calling claimRewards triggers reward accounting that counts the fresh deposit as yield, and the attacker withdraws it as their pro-rata reward.
**Insight:** In vault reward accounting, check whether the balance-based 'unprocessed rewards' delta is computed before or after the incoming deposit lands; any deposit path that calls the reward updater after receiving ETH lets existing shareholders siphon new principal.