# increaseNetworkTotal() allows big arbitrage opportunities by depositing before an increase transaction Crit/High · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-H03 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description Increasing the network total is done via the [increaseNetworkTotal()](https://github.com/JackFrostDev/glacier-contracts/blob/main/contracts/protocol/GlacialAVAX/glAVAX.sol#L425) function call. Given that glAVAX allows instant withdrawals, it's very easy for MEV bots to steal rewards from legitimate users. They can front-run an increaseNetworkTotal() transaction, deposit AVAX, then the shares/wAVAX ratio increases and they withdraw, profiting without contributing to the network. Note that this does not happen in rebalance() because the ratio is maintained. ### Recommendation Since the network is rebalanced every 24 hours, consider distributing the rewards over a 24h period. This way, bots can't steal yield from the network without having their wAVAX staked for the next rebalance call or contributing by letting other users withdraw. This could be achieved by setting a new state variable rewardsPerSecond which accrues to totalNetworkAVAX over a certain time period (24h would be enough because if bots deposited and wanted to claim the full amount they would have to wait 24h, which by then they AVAX could be used in the network). The bigger the interval, the smaller the MEV window. ### Status This issue has been addressed in commit: [#a990358](https://github.com/threesigmaxyz/glacier-contracts-foundry/commit/a990358343a33777965cefc3bb68df76020573cc). --- Related findings: - [Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull](https://0xsimao.com/findings/tokemak-rewards-info-pulled-pull): Tokemak