# It is impossible to slash queued withdrawals that contain a malicious strategy due to a misplacement of the ++i increment

Misplaced ++i in StrategyManager.slashQueuedWithdrawal makes indicesToSkip ignored, so a malicious strategy that reverts on withdraw blocks slashing of the whole queued withdrawal.

- Payout: Contest reward
- Severity: high
- Program: EigenLayer
- Credited: juancito
- Disclosed: 2023-07-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-eigenlayer-findings/issues/205
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-eigenlayer%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** StrategyManager.slashQueuedWithdrawal loop in EigenLayer core contracts
**Root cause:** The ++i increment sits inside the else branch, so when an index is skipped i is never advanced; the loop re-evaluates the same i, the skip condition no longer matches, and the malicious strategy's withdraw() is called anyway.
**Steps:**
1. Queue a withdrawal whose strategies array includes a strategy whose withdraw() always reverts.
2. Owner calls `slashQueuedWithdrawal(recipient, queuedWithdrawal, tokens, indicesToSkip)` with `indicesToSkip[0] = 0`.
3. Loop at i=0 matches skip, increments indicesToSkipIndex to 1, but i stays 0.
4. Next iteration skip condition `1 < 1` is false, so `strategies[0].withdraw(...)` is invoked and reverts.
5. Slash transaction always reverts; adversary later completes the withdrawal.
**How found:** Code reading of the slashQueuedWithdrawal loop: noticed ++i only executes in the else branch, contradicting the documented indicesToSkip behavior; confirmed with a Foundry test showing the skipped strategy is still slashed.
**Exploitation:** Adversary registers/uses a strategy that reverts on withdraw, queues a withdrawal containing it, and the owner's slash attempt reverts, preserving the adversary's shares so they can complete the withdrawal and escape slashing.
**Insight:** When auditing skip-index loops, verify the loop counter advances on every iteration including skip branches; a skip that doesn't advance i silently re-processes the same element and defeats the skip list.