# ValidatorWithdrawalVault.distributeRewards can be called to make operator slashable

Permissionless distributeRewards zeroes vault balance before settleFunds, so operatorShare drops below accrued penalty and operator gets slashed.

- Payout: Contest reward
- Severity: medium
- Program: Stader Labs
- Credited: rvierdiiev
- Disclosed: 2023-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-stader-findings/issues/86
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-stader%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:race-window vuln:access-control vuln:business-logic

**Target:** ValidatorWithdrawalVault.distributeRewards / settleFunds
**Root cause:** distributeRewards is permissionless and zeroes the vault balance; settleFunds computes operatorShare from that balance, so calling it before the 32 ETH withdrawal arrives leaves operatorShare below penaltyAmount and triggers slashing.
**Steps:**
1. Operator has validator with accrued penalty 4.5 ETH and vault balance 1 ETH (operatorShare 1 ETH).
2. Attacker observes 32 ETH deposit being sent to ValidatorWithdrawalVault and frontruns with `distributeRewards()`, zeroing balance.
3. 32 ETH arrives; settleFunds computes operatorShare = 4 ETH < penalty 4.5 ETH.
4. Operator is slashed; without the frontrun operatorShare would be 1+4=5 ETH > penalty and no slash.
**How found:** Code reading of distributeRewards (permissionless, zeroes balance) versus settleFunds (derives operatorShare from balance) revealed an ordering dependency exploitable via frontrunning.
**Exploitation:** Attacker frontruns the validator withdrawal deposit with a permissionless distributeRewards call to reset vault balance, forcing operatorShare below penaltyAmount at settle time and causing the operator to be slashed.
**Insight:** When a permissionless function zeroes a balance that a later settlement function reads to compute a share, check whether frontrunning it changes the share relative to a penalty/threshold.