# Withdrawing wrong LPToken from GiantPool leads to loss of funds

GiantPoolBase.withdrawLPTokens burns GiantLP without verifying the withdrawn LP token was deposited for staking ETH, letting an attacker inject worthless LP tokens and trick victims into burning valuable GiantLP.

- Payout: Contest reward
- Severity: medium
- Program: Stakehouse Protocol
- Credited: aphak5010
- Disclosed: 2023-01-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/98
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** GiantPoolBase / GiantSavETHVaultPool liquid staking contracts
**Root cause:** withdrawLPTokens only checks the caller holds enough GiantLP to burn, not that the LP token being withdrawn was originally deposited into the GiantPool in exchange for staking ETH.
**Steps:**
1. Attacker deploys own LPToken contract and mints a huge supply.
2. Attacker transfers malicious LP tokens to the GiantPool, satisfying `_assertUserHasEnoughGiantLPToClaimVaultLP`.
3. Attacker tricks victim (Bob) into calling `GiantPoolBase.withdrawLPTokens` selecting the attacker's LP token.
4. Bob's GiantLP is burnt 1:1 and he receives worthless attacker LP tokens; internal LP:GiantLP accounting is also broken, stranding LP tokens.
**How found:** Code review of withdrawLPTokens: noticed the function burns GiantLP and releases LP tokens but never verifies the LP token's provenance/deposit, then reasoned about attacker-controlled LP token injection and accounting mismatch.
**Exploitation:** Attacker seeds the GiantPool with self-issued LP tokens, then socially engineers a victim into withdrawing those tokens; victim's GiantLP (redeemable for ETH) is burned for worthless tokens.
**Insight:** When a pool releases a token by burning a receipt token, check whether the released token's identity/provenance is validated against what was actually deposited — attacker-supplied token contracts can be swapped in to drain receipt-token value.