# Pool owner can sandwich deposits into his pool to keep their fs at 1 while being able to withdraw ETH earnings

Pool owner frontruns incoming ethStake deposits, withdrawing ETH earnings just before owner fees restore financial stability to 1.

- Payout: Contest reward
- Severity: medium
- Program: Goat
- Credited: Aslanbek Aibimov
- Disclosed: 2024-06-12
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_goat_mar2024.pdf#3.2.7
- Library page: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.7
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:chained technique:race-window vuln:business-logic

**Target:** Staking pool financial-stability / ETH earnings withdrawal logic
**Root cause:** Financial stability (current ETH earnings / max ETH earnings) is recomputed from live earnings, so a withdrawal that lowers FS is immediately offset by owner fees from a pending deposit, letting the owner extract ETH without lasting penalty.
**Steps:**
1. Bob signs `ethStake` staking 50 ETH into Alice's pool.
2. Alice frontruns Bob's tx and withdraws 1 ETH from her EthEarnings, dropping her FS.
3. Bob's tx executes, paying Alice 1 ETH in owner fees, restoring FS to 1.
**How found:** Observed that FS is a ratio of current to max ETH earnings and that owner fees from deposits increase earnings; reasoned that a withdrawal timed against an incoming deposit would be masked by the fee inflow.
**Exploitation:** Pool owner monitors mempool for ethStake txs into their pool, frontruns by withdrawing an amount of ETH earnings equal to the owner fees the pending deposit will generate, so the deposit's fees instantly restore FS to 1 while the owner keeps the withdrawn liquid ETH.
**Insight:** When a penalty metric is a live ratio recomputed on each action, look for a second action (here, deposit-generated owner fees) that moves the denominator/numerator back within the same block, letting the penalized action be sandwiched.