# OmniEstate staking pool: missing input check drains rewards

OmniEstate staking pool's invest() lacked input validation, letting an attacker stake 1 ORT and withdraw a disproportionate reward, netting ~236 BNB.

- Payout: Real-world hack
- Severity: high
- Program: - OmniEstate
- Analysis by: DeFiHackLabs
- Disclosed: 2023-01-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-01/OmniEstate_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230117-omniestate
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** OmniStakingPool staking contract (invest/withdrawAndClaim) on BSC
**Root cause:** invest() did not validate the qty_ort/end_date inputs, so a minimal stake (1 wei ORT, end_date 0) still qualified for withdrawal and claim of outsized rewards.
**Steps:**
1. Wrap 1 BNB to WBNB and swap to ORT via PancakeSwap router `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
2. Approve Omni contract for max ORT and call `invest(0, 1)` (end_date=0, qty_ort=1).
3. Read lock id via `getUserStaking(address(this))`.
4. Call `withdrawAndClaim(stake_[0])` to pull principal plus inflated rewards.
5. Swap all ORT back to WBNB for profit.
**Exploitation:** Attacker funded a tiny ORT position, staked 1 wei with end_date 0, then immediately withdrew and claimed, receiving far more ORT than staked; converted proceeds to ~236 BNB (~$70k).
**Insight:** Staking contracts that accept user-supplied qty and end_date without bounds checks let a 1-wei stake with end_date=0 bypass lock/reward math; test invest() with minimal amounts and zero timestamps to see if reward accrual is decoupled from stake size.