# EIP1559 rewards received by syndicate during the period when it has no registered knots can be lost

EIP1559 rewards sent to a Stakehouse syndicate while it has zero registered knots get misallocated to a later node runner or locked forever.

- Payout: Contest reward
- Severity: medium
- Program: Stakehouse Protocol
- Credited: rbserver
- Disclosed: 2023-01-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/376
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-21
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Syndicate / LiquidStakingManager Solidity contracts
**Root cause:** updateAccruedETHPerShares has an empty else branch when numberOfRegisteredKnots==0, so ETH received during that window is never accrued to any share and stays unaccounted in the syndicate balance.
**Steps:**
1. Deposit stake and mint derivatives for blsPubKeyFour so syndicate has one knot.
2. Send `0.6743 ether` EIP1559 tips to `manager.syndicate()` via raw call.
3. As DAO call `deRegisterKnotFromSyndicate([blsPubKeyFour])` and `restoreFreeFloatingSharesToSmartWalletForRageQuit(...)` reducing numberOfRegisteredKnots to 0.
4. Warp 3h; feesAndMevUser calls `stakingFundsVault.claimRewards` and nodeRunner calls `claimRewardsAsNodeRunner` to drain pre-deregistration rewards.
5. Send another `0.6743 ether` to syndicate while numberOfRegisteredKnots==0; both claim paths now revert or no-op, ETH stays in syndicate.
6. Register new knot blsPubKeyTwo via `depositStakeAndMintDerivativesForDefaultNetwork`; nodeRunner calls `claimRewardsAsNodeRunner` and receives half the stranded ETH; other half remains locked (`syndicate.balance == eip1559Tips/2 + 1`).
**How found:** Code reading of updateAccruedETHPerShares revealed an explicit `// todo - check else case for any ETH lost` in the else branch, prompting a Foundry PoC to confirm stranded ETH and misattribution.
**Exploitation:** After a knot is deregistered leaving zero knots, tips sent to the syndicate accumulate unaccounted. When a new knot registers, its node runner claims half of the stranded ETH despite not being entitled; the LP half is stuck because StakingFundsVault.claimRewards reverts (arithmetic error) for non-first BLS keys.
**Insight:** Look for explicit TODO/empty else branches in reward-accrual accounting; zero-count states (no knots, no shares, no stakers) often leave incoming ETH unaccounted and later claimable by unrelated parties.