# Attacker can grift syndicate staking by staking a small amount

Anyone can front-run mintDerivatives by staking 1 gwei into Syndicate, pushing total over the 12 ETH cap and reverting the victim's auto-stake.

- Payout: Contest reward
- Severity: medium
- Program: Stakehouse Protocol
- Credited: Lambda
- Disclosed: 2023-01-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/146
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-12
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LiquidStakingManager._autoStakeWithSyndicate / Syndicate.stake (Solidity contracts)
**Root cause:** Syndicate.stake is permissionless and enforces a hard 12 ETH total cap, while _autoStakeWithSyndicate always stakes a fixed 12 ETH, so any prior stake makes the auto-stake revert.
**Steps:**
1. Attacker holds sETH and watches mempool for a mintDerivatives tx that triggers _autoStakeWithSyndicate.
2. Attacker front-runs by calling `Syndicate.stake(1 gwei)`, raising totalStaked.
3. Victim's _autoStakeWithSyndicate calls `Syndicate.stake(12 ether)`; check `_sETHAmount + totalStaked > 12 ether` is now true.
4. Call reverts with InvalidStakeAmount, blocking the victim's mintDerivatives.
**How found:** Code reading: noticed _autoStakeWithSyndicate hardcodes 12 ETH while Syndicate.stake caps total at 12 ETH and is callable by anyone, implying a griefing front-run.
**Exploitation:** Repeated front-running of mintDerivatives calls with a 1 gwei stake each time to grief syndicate staking and block derivative minting; no direct value extraction described.
**Insight:** When a fixed-amount internal call targets a permissionless function with a hard cap, check whether an outsider can pre-fill the cap to force reverts; look for hardcoded amounts vs. shared mutable totals.