From 44636659e3412050f41bdc70791fc70fb41ef4c4 Mon Sep 17 00:00:00 2001
From: Uncle Fatso <uncle.fatso@ghostchain.io>
Date: Sat, 10 Oct 2026 19:21:31 +0300
Subject: [PATCH] 
 https://ghostforum.org/t/ghoststaking-stake-direct-claim-branch-ignores-the-external-deposit-lock-letting-any-account-force-funds-into-an-opted-out-wallet/135

Signed-off-by: Uncle Fatso <uncle.fatso@ghostchain.io>
---
 src/Staking.sol | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/Staking.sol b/src/Staking.sol
index bcca90b..d49e053 100644
--- a/src/Staking.sol
+++ b/src/Staking.sol
@@ -79,12 +79,14 @@ contract GhostStaking is IStaking, GhostAccessControlled {
         bool isRebase,
         bool isClaim
     ) external override returns (uint256 returnAmount) {
+        if (locks[to] && to != msg.sender) revert ExternalDepositsLocked();
+
         returnAmount = amount + rebase();
         IERC20(ftso).safeTransferFrom(msg.sender, address(this), amount);
+
         if (isClaim && warmupPeriod == 0) {
             returnAmount = _sendStnkBased(returnAmount, to, isRebase);
         } else {
-            if (locks[to] && to != msg.sender) revert ExternalDepositsLocked();
             uint48 expiry = epoch.number + warmupPeriod;
             IGhostWarmup(warmup).addToWarmup(returnAmount, to, expiry);
         }