# Adversary can stake LP directly for the vault then withdraw to break lp accounting in BLVaultManagerLido

Attacker stakes LP directly to their Olympus vault via Aura stakeFor, then withdraws, decrementing manager totalLp below real deposits and trapping other users' withdrawals.

- Payout: Contest reward
- Severity: high
- Program: Olympus
- Credited: 0x52
- Disclosed: 2023-03-16
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-03-olympus-judging/issues/4
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-olympus%3AH-3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BLVaultManagerLido / BLVaultLido vault contracts
**Root cause:** Vault withdraw calls manager.decreaseTotalLp without verifying the vault actually deposited that LP; Aura's stakeFor lets anyone credit LP to a vault without going through the manager's deposit path, so totalLp can be driven below actual vault deposits.
**Steps:**
1. Attacker calls AuraRewardPool.stakeFor(victimVaultOrOwnVault, lpAmount) to credit LP to a vault without manager tracking.
2. Attacker calls BLVaultLido.withdraw(lpAmount) on that vault, which invokes manager.decreaseTotalLp(lpAmount) and withdrawAndUnwrap.
3. totalLp is decremented for LP never counted as deposited, so totalLp < real LP held by other vaults.
4. Other users' withdraw reverts at `if (amount_ > totalLp) revert BLManagerLido_InvalidLpAmount()`, trapping them.
**How found:** Reading Aura BaseRewardPool.stakeFor showed LP can be credited to any address outside the manager's deposit flow; tracing BLVaultLido.withdraw to decreaseTotalLp revealed the accounting mismatch.
**Exploitation:** Attacker needs LP tokens and a vault; stakes LP directly via Aura stakeFor to their vault, then withdraws through the vault to decrement global totalLp, permanently blocking other vaults' withdrawals.
**Insight:** When integrating external reward pools, check for alternate entry points (stakeFor, transfer, mint) that let balances reach your contract without your own accounting hooks; any withdraw path that decrements a global counter must verify per-vault deposited amounts.