# Attacker could front run User's claim at DefiAppHomeCenter.claim()

DefiAppHomeCenter.claim() overrides the configured receiver with msg.sender when staking, letting an attacker front-run a victim's claim and steal their tokens.

- Payout: Contest reward
- Severity: medium
- Program: Defi App
- Credited: hrmneffdii
- Disclosed: 2025-03-27
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_defi_app_february2025.pdf#3.2.3
- Library page: https://bugbountylibrary.com/r/cantina%3Adefi_app_february2025%3A3.2.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** DefiAppHomeCenter.claim() Merkle claim with staking
**Root cause:** When staking.weth9ToStake > 0, StakeHelper.stakeClaimedLogic is called with msg.sender instead of the receiver stored in $e.userConfigs[distro.userId].receiver, so the caller becomes the beneficiary.
**Steps:**
1. Attacker observes victim's pending claim tx with staking params (weth9ToStake > 0).
2. Attacker submits `center.claim{value:1}(epoch, victimDistroInput, victimDistroProof, withStaking)` with same Merkle proof, front-running the victim.
3. claimLogic validates proof and credits receiver = msg.sender (attacker) due to staking override.
4. Attacker receives the claimed tokens; victim's subsequent claim reverts (already claimed).
**How found:** Code review of claim() noting the commented-out receiver lookup and the direct msg.sender passed to stakeClaimedLogic, spotting the mismatch between configured receiver and staking path.
**Exploitation:** Attacker copies the victim's Merkle distro input/proof from the mempool, sets staking.weth9ToStake > 0 to trigger the msg.sender override, and front-runs with a 1 wei payment, receiving the full claim amount.
**Insight:** When a claim/distribution function has two payout paths, check whether each path resolves the beneficiary consistently; a staking or side-effect branch that substitutes msg.sender for the stored receiver enables mempool front-running theft of any pending claim.