# Staked assets can be locked in Lido, due to vulnerable check in YieldEthStakingLido::protocolDeposit

YieldEthStakingLido only checks each individual stake against Lido's 1000 stETH withdrawal cap, so incremental stakes can exceed it and lock funds.

- Payout: Contest reward
- Severity: medium
- Program: BendDAO
- Credited: oakcobalt
- Disclosed: 2025-01-22
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-benddao-invitational#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-benddao-invitational%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** YieldEthStakingLido.sol protocolDeposit / YieldStakingBase._stake
**Root cause:** protocolDeposit validates only the per-call amount against MAX_STETH_WITHDRAWAL_AMOUNT, not the cumulative yieldShare for the position; repeated stake() calls accumulate past the cap.
**Steps:**
1. Call stake() repeatedly on the same NFT with borrowAmount <= MAX_STETH_WITHDRAWAL_AMOUNT each time.
2. Each call passes the `require(amount <= MAX_STETH_WITHDRAWAL_AMOUNT)` check in protocolDeposit.
3. sd.yieldShare accumulates beyond 1000 stETH.
4. Attempt unstake: Lido rejects withdrawal requests above MAX_STETH_WITHDRAWAL_AMOUNT and the contract cannot split the position, so funds remain locked.
**How found:** Read Lido WithdrawalQueue's MIN/MAX_STETH_WITHDRAWAL_AMOUNT bounds, then noticed protocolDeposit checks only the single-call amount while _stake allows repeated deposits incrementing sd.yieldShare.
**Exploitation:** User incrementally stakes via multiple stake() calls on one NFT until cumulative yieldShare exceeds Lido's 1000 stETH withdrawal max; unstaking then fails because the position cannot be split into multiple Lido withdrawal requests.
**Insight:** When a downstream protocol enforces per-request min/max bounds, verify the integrating contract checks the cumulative position size, not just each deposit, and that it can split withdrawals.