# ETH sent when calling executeAsSmartWallet function can be lost

LiquidStakingManager.executeAsSmartWallet is payable but never forwards msg.value to the smart wallet, so DAO-sent ETH is locked in the manager while the wallet's own balance funds the call.

- Payout: Contest reward
- Severity: medium
- Program: Stakehouse Protocol
- Credited: rbserver
- Disclosed: 2023-01-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/377
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-22
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** LiquidStakingManager.executeAsSmartWallet
**Root cause:** executeAsSmartWallet accepts msg.value but calls OwnableSmartWallet.execute without forwarding value, so the smart wallet pays _value from its own balance and the sent ETH stays in the manager.
**Steps:**
1. DAO calls `manager.executeAsSmartWallet{value: 1.5 ether}(nodeRunner, to, "", 1.5 ether)`
2. Manager invokes `IOwnableSmartWallet(smartWallet).execute(_to, _data, _value)` with no value attached
3. Smart wallet's functionCallWithValue pays 1.5 ETH from its own balance to target
4. Manager retains the 1.5 ETH; assert `address(manager).balance == 1.5 ether` and wallet balance decreased
**How found:** Code reading of the payable executeAsSmartWallet wrapper versus the inner execute call, noticing msg.value is never forwarded; confirmed with a Foundry test asserting manager balance retention.
**Exploitation:** Requires DAO (onlyDAO) to call the payable function with value; no attacker path — funds are simply stranded in the manager and the node runner's wallet is unexpectedly debited.
**Insight:** For any payable wrapper that delegates to an inner call, check whether msg.value is actually forwarded — a payable signature without `{value: msg.value}` silently strands funds while the inner contract pays from its own balance.