# Malicious poolowner can withdraw earnings without affecting trust score

Pool owner reinvests earnings into a self-owned 99% owner-share pool, then withdraws them, evading the trust-score penalty for withdrawing earnings.

- Payout: Contest reward
- Severity: high
- Program: Goat
- Credited: Spearmint
- Disclosed: 2024-06-12
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_goat_mar2024.pdf#3.1.12
- Library page: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.12
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** Earning/PoolFactory/EthSharing staking and trust-score contracts on Arbitrum Sepolia
**Root cause:** Trust score (Fs = ETH_Earning/Max_ETH_Earning) only tracks the primary pool's earnings; reinvesting into a second pool with 99% owner share moves earnings out of the tracked pool without zeroing Fs, and the second pool's owner can then withdraw freely.
**Steps:**
1. Create a second account and stake a small amount to create its pool via `controller.ethStake`.
2. Set the second pool's owner share to 99% via `ethSharing.configPool(9999, 0)`.
3. From the main account call `controller.earningReinvest(true, secondAccount, 720 days, earnings, 1000, 99990000)` to move earnings into the second pool.
4. Second pool owner receives 99% of staked amount as earnings (1% to dev team).
5. Call `controller.earningWithdraw(true, earning.earningOf(secondAccount), secondAccount, 1)` to cash out.
6. Observe main account's trust score token balance unchanged before and after.
**How found:** Reviewer read the docs' definition of reputation as willingness not to withdraw earnings, noted Fs drops to 0 on withdrawal, and hypothesized that routing earnings through a second pool with a high owner share would avoid touching the tracked pool's Fs.
**Exploitation:** Attacker stakes to build earnings and reputation, then reinvests all earnings into a colluding pool configured at 99% owner share, capturing 99% as withdrawable earnings in that pool, and immediately withdraws them to their own wallet while the primary pool's Fs and trust score remain intact.
**Insight:** When a reputation metric is computed from a single pool's balance, check whether value can be moved to a sibling/self-controlled pool with skewed share config so the metric's denominator never changes; test share-config extremes (99% owner) as an evasion vector.