# ValidatorWithdrawalVault.settleFunds doesn't check amount that user has inside NodeELRewardVault to pay for penalty

ValidatorWithdrawalVault.settleFunds only counts CL earnings when applying penalties, ignoring NodeELRewardVault EL rewards, so operators with sufficient combined balance still get slashed.

- Payout: Contest reward
- Severity: medium
- Program: Stader Labs
- Credited: rvierdiiev
- Disclosed: 2023-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-stader-findings/issues/84
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-stader%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ValidatorWithdrawalVault / NodeELRewardVault smart contracts
**Root cause:** settleFunds computes validator earnings solely from ValidatorWithdrawalVault balance (CL attestation rewards) while penalties include _mevTheftPenalty tied to EL rewards held in NodeELRewardVault; the EL balance is never counted before deciding to slash SD collateral.
**Steps:**
1. Validator accrues 0.1 ETH CL earnings in ValidatorWithdrawalVault and 0.05 ETH EL rewards in NodeELRewardVault.
2. Accrued penalty totals 0.11 ETH (mev theft + missed attestation).
3. Validator exits; settleFunds fetches penalty and compares only against ValidatorWithdrawalVault balance (0.1 < 0.11).
4. SD collateral is slashed even though combined 0.15 ETH exceeds the penalty.
**How found:** Code reading of settleFunds: noticed earnings computed only from ValidatorWithdrawalVault balance while penalty includes _mevTheftPenalty, which corresponds to NodeELRewardVault earnings — a mismatch between where rewards accrue and where penalties are checked.
**Exploitation:** Operator is unfairly slashed (loss of SD collateral) despite having sufficient combined CL+EL earnings to cover the penalty; no attacker gain beyond avoiding/being wrongly subject to slashing.
**Insight:** When a contract computes a penalty against a balance, verify that all reward streams the penalty references (CL vs EL, separate vaults) are aggregated before deciding to slash collateral; split reward accounting is a common source of wrongful slashing.