A single-character bug in a boundary check (> instead of >=) allows attackers to claim VTHO rewards forever, even after they've unstaked. An attacker can stake, delegate, exit, and then continue to drain rewards from the protocol indefinitely using a "ghost stake." If exploited, this would systematically siphon all VTHO rewards from legitimate delegators until the contract is empty.
Vulnerability Details
The vulnerability is an off-by-one error in _claimableDelegationPeriods. When a delegator has exited and claimed all their rewards up to their endPeriod, the next check incorrectly falls through due to a strict greater-than comparison.
File: packages/contracts/contracts/Stargate.sol
// ...if ( endPeriod != type(uint32).max && endPeriod < currentValidatorPeriod && endPeriod > nextClaimablePeriod // ❌ BUG: Should be >=) {return (nextClaimablePeriod, endPeriod);}// Attacker falls through to hereif (nextClaimablePeriod < currentValidatorPeriod) {return (nextClaimablePeriod, completedPeriods); // ❌ Returns future periods}// ...
When nextClaimablePeriod is exactly endPeriod + 1, the check endPeriod > nextClaimablePeriod is false. The code falls through to the next if block intended for active delegators, and incorrectly grants the attacker claimable periods they are not entitled to.
The theft occurs in _claimableRewardsForPeriod. The reward is calculated as:
1
1. Numerator: effectiveStake
This is read from the attacker's NFT, which still holds the original stake amount.
2
2. Denominator: delegatorsEffectiveStake
This is read from a checkpointed value. When the attacker exited, this total was correctly decreased.
The mismatch: the attacker's stake is included in the reward calculation (numerator) but excluded from the total stake (denominator). This allows them to claim a share of rewards they didn't contribute to, effectively stealing from everyone else who is still staked.
Impact Details
This is a critical vulnerability leading to direct theft of funds.
Infinite Drain: The attack can be repeated every time a new validator period completes. The attacker's initial stake is fully recoverable, so the only cost is gas.
Total Loss of Rewards: One or more attackers can systematically drain the entire VTHO reward pool held by the Stargate contract. Legitimate users will find their rewards diluted to zero over time.
High Profitability: An attacker can stake a large amount, exit, and then repeatedly claim rewards forever. The PoC shows extremely high ROI over many periods with minimal capital risk.
References
Vulnerable Function (_claimableDelegationPeriods):
https://github.com/vechain/stargate/blob/main/packages/contracts/contracts/Stargate.sol#L916-L930
Proof-of-Concept test that reproduces the exploit (Hardhat + TypeChain). The test stakes, delegates, exits, and then demonstrates that the attacker can claim post-exit periods.
