# Freezing of funds - Hacker can prevent users withdraws in giant pools

Zero-value GiantLP transfer resets lastInteractedTimestamp, making withdrawDETH/withdrawLP revert with 'Too new' and freezing user withdrawals in giant pools.

- Payout: Contest reward
- Severity: medium
- Program: Stakehouse Protocol
- Credited: 0xdeadbeef0x
- Disclosed: 2023-01-20
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/49
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos

**Target:** GiantSavETHVaultPool / GiantMevAndFeesPool withdraw functions and GiantLP token
**Root cause:** _afterTokenTransfer updates lastInteractedTimestamp for both sender and recipient on every transfer, including zero-amount transfers; the withdraw cooldown check `lastInteractedTimestamp + 1 days < block.timestamp` can thus be reset by anyone at will.
**Steps:**
1. Attacker calls `giantSavETHPool.lpTokenETH().transfer(victim, 0)` (or front-runs the victim's withdraw tx)
2. _afterTokenTransfer sets `lastInteractedTimestamp[victim] = block.timestamp`
3. Victim calls `withdrawDETH(...)` or `withdrawLP(...)`
4. `_assertUserHasEnoughGiantLPToClaimVaultLP` reverts with 'Too new' because cooldown not elapsed
5. Repeat each day or front-run to permanently block withdrawal
**How found:** Code review of the withdraw flow and _assertUserHasEnoughGiantLPToClaimVaultLP cooldown check, noticing _afterTokenTransfer unconditionally updates lastInteractedTimestamp for recipient on any transfer including zero amount.
**Exploitation:** Attacker sends a 0-amount lpTokenETH transfer to the victim (cost: gas only) either periodically or by front-running the victim's withdraw transaction, resetting the cooldown and forcing the withdraw to revert.
**Escalation:** Repeated/front-run griefing across all giant pool withdraw paths (WithdrawLP in GiantMevAndFeesPool and GiantSavETHVaultPool, WithdrawDETH) causes liquidity crunch and pool insolvency for ETH/dETH/LP returns.
**Insight:** Cooldown/timestamp checks keyed on token transfer hooks can be griefed by zero-value transfers; look for state updated in _afterTokenTransfer/_beforeTokenTransfer that gates withdrawals and test whether a 0-amount transfer resets it.