# depositETHOverTargetWeight() malicious modifications poolIdArrayIndexForExcessDeposit

depositETHOverTargetWeight rolls poolIdArrayIndexForExcessDeposit forward even with insufficient ETH, letting a 1-wei transfer steer next round's allocation to a chosen pool.

- Payout: Contest reward
- Severity: medium
- Program: Stader Labs
- Credited: bin2chen
- Disclosed: 2023-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-stader-findings/issues/175
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-stader%3AM-09
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StaderStakePoolsManager.poolAllocationForExcessETHDeposit / depositETHOverTargetWeight
**Root cause:** The allocation loop advances i = (i+1) % poolCount and writes poolIdArrayIndexForExcessDeposit before checking whether any validator was actually funded, so a round with zero capacity still rotates the priority index.
**Steps:**
1. Note poolIdArrayIndexForExcessDeposit = 1 and StaderStakePoolsManager balance = 0.
2. Attacker with a validator queued in pool 2 transfers 1 wei to the manager, triggering depositETHOverTargetWeight.
3. Loop computes selectedPoolCapacity all zero, ethToDeposit stays < ETH_PER_NODE, so i advances to 2 and poolIdArrayIndexForExcessDeposit = 2.
4. Next real funding round starts allocation at pool 2, favoring attacker's validator.
**How found:** Code reading of poolAllocationForExcessETHDeposit: noticed the index is incremented and persisted unconditionally before the break, even when selectedPoolCapacity is zero, meaning a no-op deposit still shifts allocation priority.
**Exploitation:** Attacker sends a dust amount to the stake pools manager to force the excess-deposit index to rotate to their pool, so the next allocation round prioritizes their validator; cooldown limits frequency.
**Insight:** In round-robin allocation loops, check whether the cursor/index is persisted on iterations that allocate nothing; a dust deposit that funds zero validators can still rotate priority in the attacker's favor.