# Bond tokens (HLG) can get permanently stuck in operator

Non-operator who executes a job receives slashed HLG bond but can never bond or withdraw it, permanently locking tokens in HolographOperator.

- Payout: Contest reward
- Severity: medium
- Program: Holograph
- Credited: minhtrng
- Disclosed: 2022-12-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-holograph-findings/issues/322
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-holograph%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** HolographOperator.executeJob / bondUtilityToken
**Root cause:** executeJob credits slashed bond amount to msg.sender even when msg.sender is not an operator, but bondUtilityToken requires _bondedAmounts==0 to bond, so the credited amount can never be withdrawn.
**Steps:**
1. Wait until timeDifference >= 6 so the fallback-operator check is skipped in executeJob.
2. Call `executeJob` as a non-operator address; `_bondedAmounts[job.operator] -= amount; _bondedAmounts[msg.sender] += amount` credits the slashed HLG to msg.sender.
3. Attempt `bondUtilityToken` to become an operator: reverts with 'HOLOGRAPH: operator is bonded' because `_bondedAmounts[msg.sender] != 0`.
4. Tokens remain stuck; no withdraw path for non-operator bonded amounts.
**How found:** Code reading of executeJob's slashing branch: noticed the timeDifference<6 check gates the fallback-operator validation, so any msg.sender can receive the slash credit, then cross-checked bondUtilityToken's zero-balance requirement.
**Exploitation:** Anyone can call executeJob after the time window; the slashed bond is credited to the caller's _bondedAmounts, but a non-operator caller has no path to unbond or withdraw, locking the HLG permanently.
**Insight:** When a reward/slash is credited to msg.sender, verify the recipient can actually withdraw it; check bonding/withdrawal preconditions against every code path that mutates balances.