# DAO or lsdn owner can steal funds from node runner

LiquidStakingManager.rotateNodeRunnerOfSmartWallet lacks checks for pending node-runner ETH, letting DAO/LSD owner swap in their own address and withdraw the 4 ETH deposit.

- Payout: Contest reward
- Severity: medium
- Program: Stakehouse Protocol
- Credited: koxuan
- Disclosed: 2023-01-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/109
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LiquidStakingManager smart contract (rotateNodeRunnerOfSmartWallet)
**Root cause:** rotateNodeRunnerOfSmartWallet replaces the node runner without verifying or settling outstanding ETH/rewards owed to the previous node runner, so the new address inherits the smart wallet's balance.
**Steps:**
1. Deploy/register a BLS pubkey with nodeRunner as the smart wallet's node runner
2. nodeRunner deposits 4 ether into the smart wallet
3. As admin/DAO owner call `manager.rotateNodeRunnerOfSmartWallet(nodeRunner, attacker, true)`
4. As attacker call `manager.withdrawETHForKnot(attacker, blsPubKeyOne)` to drain the 4 ETH
**How found:** Code review of rotateNodeRunnerOfSmartWallet noting absence of balance/reward settlement checks before swapping the node runner; confirmed with a Foundry PoC.
**Exploitation:** Privileged DAO/LSD owner waits until node runner deposits 4 ETH, rotates node runner to their own EOA, then calls withdrawETHForKnot to extract the deposit and any claimable rewards.
**Insight:** For privileged rotation/transfer functions, check whether pending balances or accrued rewards tied to the old role are settled before reassignment; a missing settlement check turns an admin function into a theft primitive.