# OTSeaStaking: repeated claim/withdraw on overlapping indexes drains rewards

OTSeaStaking claim/withdraw logic flaw let attacker repeatedly claim and withdraw overlapping stake indexes, draining ~26k USD of OTSea tokens.

- Payout: Real-world hack
- Severity: high
- Program: OTSeaStaking
- Credited: DeFiHackLabs
- Disclosed: 2024-09-13
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-09/OTSeaStaking_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240913-otseastaking
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** Ethereum staking contract (OTSeaStaking) with claim/withdraw by index array
**Root cause:** claim() and withdraw() accept arrays of stake indexes without marking them consumed, so the same indexes can be claimed and withdrawn repeatedly, and overlapping index sets across calls let the attacker extract more than deposited.
**Steps:**
1. Fork mainnet at block 20738190.
2. Call OTSeaRevenueDistributor.distribute() to fund rewards.
3. As attacker, loop 14x: build indexes [0..19, 20+i], call claim(indexes, attacker) then withdraw(indexes, attacker).
4. Loop 10x: indexes [0, 34+i], claim then withdraw.
5. Loop 22x: indexes [20..42, 70, 43+i], claim then withdraw.
6. Approve OTSea token to Uniswap V2 Router and swapExactTokensForETHSupportingFeeOnTransferTokens to convert drained tokens to ETH.
**Exploitation:** Attacker contract repeatedly called claim() and withdraw() with overlapping index arrays, reusing already-claimed/withdrawn stake slots to extract rewards and principal beyond entitlement, then swapped the drained OTSea tokens for ETH via Uniswap V2.
**Escalation:** Repeated overlapping index arrays across 46 claim/withdraw cycles amplified extraction to ~26k USD.
**Insight:** When a contract tracks user positions by array index and exposes batch claim/withdraw, test whether indexes are marked consumed and whether overlapping index sets across calls double-count rewards or principal.