# Virgin stake can claim all drops

xETH dripped rewards while totalSupply was zero, letting the first staker mint 1 wxETH and unstake the entire accumulated drip.

- Payout: Audit contest
- Severity: medium
- Program: xETH
- Found by: d3e4
- Disclosed: 2023-08-15
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-05-xeth#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-xeth%3AM-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** wxETH staking vault drip accounting
**Root cause:** _accrueDrip() runs independent of totalSupply(), so rewards drip into cashMinusLocked while no wxETH exists; the first staker then owns 100% of supply and captures the whole drip.
**Steps:**
1. Enable drip while totalSupply() == 0 and let at least one block pass.
2. First staker stakes 1 xETH, minting 1 wxETH; the drip modifier calls _accrueDrip() adding dripped xETH to cashMinusLocked.
3. exchangeRate() = (cashMinusLocked * BASE_UNIT) / totalSupply(); with totalSupply()==1 she unstakes and receives cashMinusLocked, i.e. 1 plus the entire drip.
**How found:** Noticed _accrueDrip() is independent of totalSupply() and reasoned about the exchangeRate() when the first staker owns the entire supply.
**Exploitation:** Attacker waits for drip to be enabled with no stakers, stakes the minimum 1 xETH to become sole holder, then immediately unstakes to withdraw the full cashMinusLocked including all dripped rewards.
**Insight:** Reward-accrual functions that don't gate on totalSupply()==0 let the first depositor capture all pre-existing accrual; check drip/accrue paths for zero-supply states.