# A staker with verified over-commitment can potentially bypass slashing completely

An over-committed staker whose shares were zeroed by over-commitment proof escapes slashing, then reclaims deducted shares on beacon-chain withdrawal.

- Payout: Contest reward
- Severity: medium
- Program: EigenLayer
- Credited: Cyfrin
- Disclosed: 2023-07-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-eigenlayer-findings/issues/408
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-eigenlayer%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StrategyManager / EigenPod slashing and over-commitment accounting
**Root cause:** Over-commitment debits staker shares to zero, but slashing only reduces current shares; the debited amount is later credited back on beacon-chain withdrawal without ever being slashed.
**Steps:**
1. Alice stakes 32 ETH, receives BeaconEthStrategy shares.
2. Alice is slashed on beacon chain; balance below restaked amount.
3. Watcher calls `EigenPod::verifyOverCommittedStake`, reducing Alice's shares to 0 (credited back later on withdrawal).
4. Alice's operator gets slashed and frozen.
5. Governance calls `StrategyManager::slashShares` on delegators; Alice has 0 shares so nothing is slashed.
6. Governance calls `ISlasher::resetFrozenStatus`.
7. Alice unstakes on beacon chain; `EigenPod::verifyAndProcessWithdrawal` credits back the previously deducted shares.
8. Alice queues and completes withdrawal with no slashing penalty.
**How found:** Code reading of StrategyManager::slashShares and EigenPod over-commitment/withdrawal credit logic; noticed slashing only touches current shares while over-commitment debit is later refunded.
**Exploitation:** Staker waits until after slashing and operator unfreeze, then unstakes on beacon chain to reclaim shares that were debited during over-commitment recording, avoiding the penalty entirely.
**Insight:** When a protocol debits balances to zero for one reason (proof of over-commitment) and later refunds them, check whether other penalty paths (slashing) account for the temporarily debited amount rather than only current balances.