# Missing access control on update() function in Earning.sol opens up many attack vectors

Missing onlyAdmin on Earning.update() lets pool owners self-deposit wstETH to inflate ETH_Earning, dodging the trust-score penalty for withdrawing earnings.

- Payout: Contest reward
- Severity: high
- Program: Goat
- Credited: Spearmint
- Disclosed: 2024-06-12
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_goat_mar2024.pdf#3.1.7
- Library page: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.7
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Earning.sol update() function (Solidity smart contract)
**Root cause:** update() lacks the onlyAdmin modifier, so anyone can call it; a poolOwner can send wstETH directly to the contract and call update() to mint/increase their ETH_Earning, bypassing the intended earnings accrual from staking.
**Steps:**
1. Identify Earning.sol update(address,bool) at L96-L115 has no onlyAdmin modifier.
2. As poolOwner, withdraw ETH_Earning to drop Fs (Financial Stability = ETH_Earning/Max_ETH_Earning), lowering trust score.
3. Transfer wstETH directly to the Earning.sol contract.
4. Call `update(account_, needShareComm_)` to _cashIn() and _mint() earnings back to the poolOwner.
5. ETH_Earning restored, Fs/trust score returns to normal without waiting for stakers or mining rewards.
**How found:** Code review of Earning.sol noticed update() lacked the onlyAdmin modifier present on admin functions, then reasoned that direct wstETH deposits plus update() could restore ETH_Earning, defeating the reputation mechanism described in the docs FAQ.
**Exploitation:** Pool owner withdraws earnings (dropping Fs), later deposits wstETH directly and calls update() to restore ETH_Earning, erasing the trust-score penalty that is supposed to punish withdrawing the majority of earnings.
**Insight:** When a protocol's core invariant is a ratio of balances (Fs = ETH_Earning/Max_ETH_Earning), check every function that mutates either side of the ratio for missing access control—self-funding the numerator can reset a penalty metric.