# Protocol will not benefit from slashing mechanism when remaining penalty bigger than minThreshold

Stader's slashValidatorSD slashes only minThreshold worth of SD instead of the full remaining penalty, so auctions under-cover operator shortfalls.

- Payout: Contest reward
- Severity: medium
- Program: Stader Labs
- Credited: Co0nan
- Disclosed: 2023-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-stader-findings/issues/292
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-stader%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ValidatorWithdrawalVault.settleFunds / SDCollateral.slashValidatorSD
**Root cause:** slashValidatorSD converts poolThreshold.minThreshold to SD and slashes min(that, balance), ignoring the actual remaining penalty (penaltyAmount - operatorShare), so the auction lot is too small to recover the shortfall.
**Steps:**
1. Call settleFunds() on a validator whose operatorShare (e.g. 1 ETH) < penaltyAmount (e.g. 5 ETH).
2. settleFunds calls slashValidatorSD(validatorId, poolId).
3. slashValidatorSD computes sdToSlash = convertETHToSD(poolThreshold.minThreshold) rather than the 4 ETH shortfall.
4. slashSD takes Math.min(sdToSlash, sdBalance) and calls Auction.createLot(sdSlashed).
5. Auction raises far less than the 4 ETH remaining penalty; protocol absorbs the loss.
**How found:** Code reading of settleFunds and slashValidatorSD: noticed the slash amount derives from poolThreshold.minThreshold instead of the computed remaining penalty, then constructed a numeric example where operatorShare < penaltyAmount.
**Exploitation:** Triggered by operator default during validator withdrawal; the shortfall between penaltyAmount and operatorShare is not fully slashed because the slash amount is capped at minThreshold, so the auction cannot recover the remaining ETH.
**Insight:** When a function caps a recovery amount by a config threshold, check whether the caller already computed the true shortfall and whether that value should be passed instead of the threshold.