# User can earn rewards by frontrunning the new rewards accumulation in Ron staking without actually delegating his tokens

Attacker frontruns Ron staking epoch update to deposit into LiquidRon, capturing a day's rewards without ever delegating tokens, then withdraws.

- Payout: Contest reward
- Severity: medium
- Program: Liquid Ron
- Credited: Aamir
- Disclosed: 2025-03-18
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-01-liquid-ron#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-liquid-ron%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:business-logic

**Target:** LiquidRon/LiquidProxy staking vault share accounting
**Root cause:** LiquidRon share price reflects getTotalRewards() which only updates at epoch boundaries; deposits are not time-locked, so a depositor can enter just before rewards accrue and exit immediately after, capturing rewards without delegating.
**Steps:**
1. Monitor RonStaking for new rewards arriving for LiquidRon's delegated balance and watch for the upcoming epoch update.
2. Frontrun the epoch update by depositing RON into LiquidRon (shares priced before new rewards reflect in totalAssets).
3. After epoch update, getTotalRewards() reflects new rewards, raising share price.
4. Immediately withdraw shares to capture proportional reward share without ever delegating.
**How found:** Reading Ron staking docs noting rewards accrue on lowest daily balance and only claimable after 24h/epoch; observed LiquidRon::totalAssets includes getTotalRewards() which only updates at period change, and that deposits lack any lock, enabling entry just before reward reflection.
**Exploitation:** Attacker needs capital equal to a meaningful share of the vault. Deposit just before epoch boundary, wait for rewards to reflect in totalAssets via getTotalRewards(), then withdraw at higher share price. No actual delegation occurs since delegateAmount is operator-driven; attacker bears no downside risk.
**Insight:** For vault/share-price protocols layered on staking that snapshots rewards at epoch boundaries, check whether deposits are time-locked relative to reward accrual; if totalAssets includes pending-but-unrealized rewards, a just-in-time deposit/withdraw captures them.