# bringUnusedETHBackIntoGiantPool in GiantMevAndFeesPool can be used to steal LPTokens

GiantMevAndFeesPool.bringUnusedETHBackIntoGiantPool trusts attacker-supplied _stakingFundsVaults, letting a fake vault's burnLPTokensForETH pull real LPTokens held by the pool.

- Payout: Contest reward
- Severity: high
- Program: Stakehouse Protocol
- Credited: datapunk
- Disclosed: 2023-01-20
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/366
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AH-21
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** GiantMevAndFeesPool.bringUnusedETHBackIntoGiantPool (Solidity liquid staking)
**Root cause:** bringUnusedETHBackIntoGiantPool accepts arbitrary _stakingFundsVaults addresses without validating them against the liquid staking manager or verifying the LP token/vault relationship, then calls burnLPTokensForETH on them with the pool as msg.sender.
**Steps:**
1. Deploy a fake vault contract implementing burnLPTokensForETH(address[] tokens, uint256[] amounts) that transfers the passed LPTokens to attacker.
2. Call GiantMevAndFeesPool.bringUnusedETHBackIntoGiantPool with _stakingFundsVaults=[fakeVault], _oldLPTokens=[realLPToken], _newLPTokens=[], _amounts=[amount].
3. Fake vault's burnLPTokensForETH executes with msg.sender=GiantMevAndFeesPool, pulling real LPTokens from the pool to attacker.
**How found:** Code reading of bringUnusedETHBackIntoGiantPool: noticed _stakingFundsVaults is used without validation while burnLPForETH verifies tokens, and that msg.sender inside burnLPTokensForETH becomes the pool, enabling a fake vault to move pool-held LPTokens.
**Exploitation:** Attacker supplies a malicious _stakingFundsVaults contract; the pool calls burnLPTokensForETH on it while holding the LP tokens, so the fake vault drains real LPTokens belonging to GiantMevAndFeesPool to attacker-controlled addresses.
**Insight:** When a function takes an external contract address as a parameter and calls it while holding valuable tokens, check whether that address is validated against a registry/manager; an unvalidated callee becomes an attacker-controlled spender with the pool as msg.sender.