# The pool owner can manipulate users to steal all of their stake amounts by using code edge case

Pool config code computed as ownerPercent*10000+userPercent collides for (1,0) and (0,10000), letting owner frontrun config change to steal all user stake.

- Payout: Contest reward
- Severity: high
- Program: Goat
- Credited: 0xRajkumar
- Disclosed: 2024-06-12
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_goat_mar2024.pdf#3.1.8
- Library page: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.8
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** Staking pool config validation (poolConfigCode)
**Root cause:** poolConfigCode is derived as ownerPercent*DEMI + userPercent, a non-injective encoding, so distinct (ownerPercent,userPercent) pairs map to the same code and pass the unchanged-config check.
**Steps:**
1. Owner creates pool with ownerPercent=1, userPercent=0 (code=10000) to attract stakers.
2. Owner runs bot monitoring staking transactions.
3. Bot frontruns each stake with configPool(ownerPercent=0, userPercent=10000) — same code 10000, passes validation.
4. User stake executes; funds go to pool.ethDistributor and owner captures all Geth since p2UDtoken supply is owner-held.
**How found:** Noticed poolConfigCode is a linear combination ownerPercent*DEMI+userPercent and reasoned that two different inputs can produce the same code, then constructed (1,0) vs (0,10000) collision.
**Exploitation:** Owner sets benign-looking percentages, then frontruns user stakes with a colliding config so the code check passes; user funds are routed to pool.ethDistributor and owner keeps all Geth while users receive no p2UDtoken.
**Insight:** When a config-integrity check hashes or encodes multiple values into one scalar, test for collisions: linear combinations like a*K+b are non-injective, so look for distinct (a,b) pairs with equal output that bypass 'unchanged config' guards.