From 12a342065742eab968e73f300fe20317ecebaa70 Mon Sep 17 00:00:00 2001
From: Uncle Fatso <uncle.fatso@ghostchain.io>
Date: Fri, 16 Oct 2026 17:53:25 +0300
Subject: [PATCH] 
 https://ghostforum.org/t/ghost-dao-contracts-external-deposit-lock-bypassed-by-unstake-wrap-unwrap-variant-of-daffh-135/173

Signed-off-by: Uncle Fatso <uncle.fatso@ghostchain.io>
---
 src/Staking.sol | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/Staking.sol b/src/Staking.sol
index ff69959..31ce1e4 100644
--- a/src/Staking.sol
+++ b/src/Staking.sol
@@ -132,8 +132,9 @@ contract GhostStaking is IStaking, GhostAccessControlled {
         bool isTrigger,
         bool isRebase
     ) external override returns (uint256) {
-        uint256 extraAmount = isTrigger ? this.rebase() : 0;
+        if (!unlocks[to] && to != msg.sender) revert ExternalDepositsLocked();
 
+        uint256 extraAmount = isTrigger ? this.rebase() : 0;
         if (isRebase) {
             amount += extraAmount;
             ISTNK(stnk).safeTransferFrom(msg.sender, address(this), amount);
@@ -152,6 +153,7 @@ contract GhostStaking is IStaking, GhostAccessControlled {
         address to,
         uint256 amount
     ) external override returns (uint256 balance) {
+        if (!unlocks[to] && to != msg.sender) revert ExternalDepositsLocked();
         ISTNK(stnk).safeTransferFrom(msg.sender, address(this), amount);
         balance = IGHST(ghst).balanceTo(amount);
         IGHST(ghst).mint(to, balance);
@@ -161,6 +163,7 @@ contract GhostStaking is IStaking, GhostAccessControlled {
         address to,
         uint256 amount
     ) external override returns (uint256 balance) {
+        if (!unlocks[to] && to != msg.sender) revert ExternalDepositsLocked();
         IGHST(ghst).burn(msg.sender, amount);
         balance = IGHST(ghst).balanceFrom(amount);
         ISTNK(stnk).safeTransfer(to, balance);