# LP unstaking only burns the shares but leaves the underlying tokens in the system, which distorts the shares-to-tokens ratio and leads to incorrect amounts being calculated during staking and unstaking

Cabal LP unstaking burns shares immediately but leaves pending undelegated tokens in the pool, inflating lp_amount so unstakers receive too many tokens and stakers too few shares.

- Payout: Contest reward
- Severity: high
- Program: Cabal
- Credited: TheSchnilch
- Disclosed: 2025-05-28
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-04-cabal-liquid-staking-token#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** Move staking module (cabal.move) LP stake/unstake accounting
**Root cause:** process_lp_unstake computes lp_amount from total staked tokens including unstaked_pending_amounts whose Cabal shares were already burned, so the shares-to-token ratio is inflated.
**Steps:**
1. User A stakes 100 ulp, User B stakes 50 ulp (total 150 ulp, 150 Cabal shares).
2. User B unstakes 50 ulp: shares burned immediately, but tokens remain in unstaked_pending_amounts for up to 3 days.
3. Pool now shows 100 Cabal shares against 150 ulp still counted in lp_amount.
4. User A unstakes 50 Cabal shares; process_lp_unstake computes unbonding_amount from inflated lp_amount, yielding 75 ulp instead of 50.
5. Verify via `debug::print(&unbonding_amount)` at cabal.move line 1334; run PoC with `initiad move test -f test_poc`.
**How found:** Code review of process_lp_unstake and process_lp_stake noticed lp_amount includes unstaked_pending_amounts whose shares were already burned, then confirmed with a Move unit test printing unbonding_amount.
**Exploitation:** Any user unstakes LP normally; during the pending undelegation window the ratio is skewed, so the unstaker's unbonding_amount is computed too high and they drain tokens belonging to other stakers. Conversely new stakers receive too few shares.
**Insight:** In share-based staking with delayed undelegation, check whether pending-unstake amounts are still counted in the denominator/numerator of share conversions after shares are burned; the window between burn and actual undelegation is where ratio math breaks.