# A part of ETH rewards can be stolen by sandwiching `claimDelayedWithdrawals()`

Attacker front-runs permissionless claimDelayedWithdrawals() by depositing LRT tokens, capturing the instant TVL jump from queued ETH rewards, then withdrawing for profit.

- Payout: Contest reward
- Severity: medium
- Program: Rio Network Core Protocol
- Credited: araj
- Disclosed: 2024-02-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-rio-network-core-protocol-judging/issues/52
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation vuln:reward-distribution

**Target:** RioLRTCoordinator / EigenLayer DelayedWithdrawalRouter reward claim flow
**Root cause:** claimDelayedWithdrawals() is permissionless and instantly increases protocol TVL; LRT share price is computed at deposit/withdrawal time, so a depositor who mints just before the claim and withdraws just after captures a proportional slice of the queued rewards without having staked for them.
**Steps:**
1. Attacker deposits accepted asset via `RioLRTCoordinator::depositETH()` to mint ~equal-value LRT tokens.
2. Attacker calls `DelayedWithdrawalRouter::claimDelayedWithdrawals(operatorDelegator, 1)` causing TVL to jump by the queued reward amount (e.g. 7.2 ETH).
3. Attacker calls `RioLRTCoordinator::requestWithdrawal(ETH_ADDRESS, token.balanceOf(bob))` for full LRT balance.
4. Wait `rebalanceDelay()`, call `rebalance(ETH_ADDRESS)`, then `claimWithdrawalsForEpoch()` to redeem at the inflated share price.
**How found:** Reviewer traced the three flows (scrapeNonBeaconChainETHFromEigenPod, partial withdrawals, validator exit excess) that queue ETH to the reward distributor, noticed the claim is permissionless and instantly raises TVL, and reasoned that share price is sampled at deposit/withdraw boundaries — enabling a classic sandwich around the claim.
**Exploitation:** No capital beyond the deposit is needed; attacker mints LRTs, triggers the permissionless reward claim to inflate TVL, then immediately requests withdrawal of all shares, redeeming a share of rewards they did not earn. POC shows ~3.6 ETH profit on a 40 ETH deposit against 8 ETH of queued rewards.
**Insight:** When a permissionless function instantly increases protocol TVL (reward claims, donation-style transfers), check whether share price is sampled at deposit/withdraw time; any such jump is sandwichable by minting before and redeeming after, even without flash loans.