# Templedao: unauthenticated migrateStake drains staking LP balance

Templedao's StaxLPStaking.migrateStake lacked access control, letting an attacker migrate the contract's entire LP balance to themselves and withdraw ~$2.3M.

- Payout: Real-world hack
- Severity: critical
- Program: Templedao
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-11
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/Templedao_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221011-templedao
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:access-control

**Target:** StaxLPStaking staking contract (migrateStake/withdrawAll)
**Root cause:** migrateStake() had no access control, so anyone could specify an arbitrary oldStaking address and amount, moving the contract's staked LP tokens to an attacker-controlled address.
**Steps:**
1. Read the staking contract's LP balance: `xFraxTempleLP.balanceOf(address(StaxLPStaking))`.
2. Call `StaxLPStaking.migrateStake(address(this), lpbalance)` with the attacker contract as oldStaking and the full balance as amount.
3. Call `StaxLPStaking.withdrawAll(false)` to redeem the migrated LP tokens.
**Exploitation:** Attacker contract called the unprotected migrateStake() passing itself as oldStaking and the staking contract's full xFraxTempleLP balance, then withdrawAll(false) to claim the LP tokens, netting ~$2.3M.
**Insight:** On staking/migration contracts, check whether migrateStake-style functions verify msg.sender and that oldStaking is a trusted prior contract; an unauthenticated migration path lets anyone redirect the pool's entire staked balance.