# _updatesponsor implementation contradicts sponsor role in pool and open's backrunning attack vectors

Goat's _updateSponsor formula fails to protect early sponsors and miscomputes staking power, letting a backrunner snatch sponsorship with 100 wei more.

- Payout: Contest reward
- Severity: high
- Program: Goat
- Credited: Spearmint
- Disclosed: 2024-06-12
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_goat_mar2024.pdf#3.1.10
- Library page: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.10
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic

**Target:** Controller.sol _updateSponsor sponsorship logic
**Root cause:** Sponsor advantage bonus is computed from the incumbent's dToken balance scaled by elapsed time, so a fresh staker with marginally more balance immediately outranks the incumbent; conversely a much larger later staker can fail to overtake because the incumbent's bonus inflates their power.
**Steps:**
1. Deploy fork of Arbitrum Sepolia Goat contracts (Controller, Profile, Locker).
2. John calls `controller.ethStake{value:1 ether}(John, 720 days, 1000, 2000300, 1, 0)` to create pool.
3. Alice calls `controller.ethStake{value:0.01 ether}(John, 30 days, 1000, 2000300, 1, 0)`; assert `profile.profileOf(John).sponsor == Alice`.
4. Eve backruns with `controller.ethStake{value:0.01 ether + 1000000000000 wei}(John, 30 days, 1000, 2000300, 1, 0)`.
5. Assert `profile.profileOf(John).sponsor == Eve` — sponsorship snatched with ~0.00000062 wsteth more.
6. Second PoC: Alice stakes 10 ETH/300d, skip 7 days, Eve stakes 60 ETH/300d; assert sponsor still Alice despite 6x stake.
**How found:** Code review of _updateSponsor against the documented sponsor definition ('highest staking power', 'early sponsors protected'); noticed the sponsorBonus formula uses the incumbent's balance and timeDiff, contradicting both stated guarantees, then validated with Foundry fork tests.
**Exploitation:** Attacker bot monitors mempool for stake txs that set a new sponsor, then backruns with a marginally larger stake (as little as ~1000 wei on Arbitrum One) to become sponsor, capturing sponsor privileges; repeated scanning/staking/unstaking lets bots monopolize sponsorships at the expense of regular users.
**Insight:** When a protocol documents invariants like 'early sponsors protected' or 'highest staking power wins', diff the actual comparison formula against the invariant — here the bonus term is added to the incumbent only, so it both fails to protect newcomers and lets a 1-wei edge flip sponsorship; test both directions (tiny over-stake and large over-stake).