# Validity and contests bond ca be incorrectly burned for the correct and ultimately verified transition

Taiko's LibProving overwrites prover/contester state on guardian override, permanently burning the correct prover's validity or contest bond with no refund path.

- Payout: Contest reward
- Severity: high
- Program: Taiko
- Credited: monrel
- Disclosed: 2024-04-26
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-03-taiko-findings/issues/266
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** TaikoL1 proving/verifying contracts (LibProving, LibVerifying)
**Root cause:** When a higher-tier or guardian proof overrides an existing transition, _overrideWithHigherProof resets prover/contester and bonds without preserving the history of the ultimately-correct transition; the guardian override path only refunds liveness bonds, not validity/contest bonds.
**Steps:**
1. Bob proves transition T1 for parent P1, posting validity bond.
2. Alice contests and proves T2 for P1 with a higher tier, slashing Bob's bond and overwriting _ts.prover/contester.
3. Guardian proves the correct T1 for P1 via TIER_GUARDIAN, becoming ts.prover.
4. After cooldown, verifyBlock verifies the block; LibVerifying pays bondToReturn to ts.prover (guardian), not Bob.
5. Bob's validity bond is permanently lost; funds sent to guardian contract are unrecoverable.
6. Run provided Foundry test `testProverLoss` to confirm Bob's balance decreases despite correct transition being verified.
**How found:** Code reading of LibProving._overrideWithHigherProof and LibVerifying bond-return logic, noticing that only liveness bonds are refundable on guardian override and that ts.prover is overwritten, so the final verified transition's history is ignored.
**Exploitation:** A contester submits a higher-tier proof against a correct transition, causing the honest prover's validity bond to be slashed and their prover record erased; when the guardian later re-proves the correct transition, the bond is paid to the guardian and locked, leaving the honest prover uncompensated.
**Insight:** In optimistic-rollup bond accounting, check whether override/guardian paths preserve the identity of the originally-correct prover; any state reset that overwrites prover/contester without a refund path freezes honest bonds.