# Slash reference timestamp reset

Penalty math reading a timestamp or decayed value that user actions can overwrite or drive to zero

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-08-27. Updated 2026-10-25._

## How it works
Slash and penalty math needs a reference point: a stake snapshot, a decayed bid amount, or a remaining balance. The bug is that this reference is derived from state a user can change. If a borrow, deposit, transfer, or late commit overwrites the timestamp or value the penalty reads, the user moves the reference to a moment when the slashable amount is already zero or near zero. The penalty then computes correctly against the wrong baseline and returns nothing.

## Where to show up
- Penalty or slash functions that read `lastBorrow`, `lastDeposit`, `lastCommit`, or similar user-triggered timestamps
- `max(...)` or `min(...)` combining a user action time with an epoch or delegation start
- Penalty amounts computed as a percentage of a value that decays over time
- Payouts capped at remaining stake, with no accounting for the shortfall
- Comments noting epoch length mismatches between the protocol and an external system

## How to review
Identify the exact variable the penalty reads and ask: can any user-callable path write it in the same block or just before the penalty triggers? The invariant: the slashable baseline must be fixed at the moment the obligation was created, not recomputed from mutable state at slash time. For decay-based penalties, check whether the decay can reach zero before the penalty window opens. For stake-capped payouts, check whether total outstanding penalties can exceed stake and who absorbs the shortfall.

## Variants seen
- Borrow in the same block as a share reduction resets `slashTimestamp` to a zero-collateral moment [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-5.md)
- Committing at decay end makes the decayed percent ~0, zeroing both residual and penalty fee [E2](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.2.md)
- Self-slashing via fake commitments drains own stake so later claimants get nothing [E3](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.14.md)

## Why fixes fail
E3 shows the cap-at-stake branch silently drops penalties beyond stake; a provider can weaponize the shortfall by overslashing themselves first. Fixing the timestamp alone does not address the queue-ordering problem.

## Impact and severity
Agents and providers escaped slashing entirely or shifted losses to later claimants [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-5.md)[E2](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.2.md)[E3](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.14.md). Severity is high where slashing is the only deterrent: the penalty exists but never fires, so misbehavior is free. Worse when the shortfall is socialized to honest participants.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-5.md
- E2: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.2.md
- E3: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.14.md