# LP Redelegation Uses Inaccurate Internal Tracker Amount, Leading to Potential Failures or Orphaned Funds

Cabal's redelegate_lp uses stale internal pool.amount instead of actual staked balance, causing redelegation to fail after slashing or orphan funds after reward accrual.

- Payout: Contest reward
- Severity: medium
- Program: Cabal
- Credited: edoscoba
- Disclosed: 2025-05-28
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-04-cabal-liquid-staking-token#m-06
- Library page: https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Move smart contract pool_router::redelegate_lp (Initia mstaking)
**Root cause:** redelegate_lp builds MsgBeginRedelegate from the internal pool.amount tracker, which drifts from the real delegation due to unreflected staking rewards and slashing.
**Steps:**
1. Configure LP pool via add_pool and stake via cabal::stake_asset so pool.amount = 1,000,000
2. Let rewards accrue to 1,050,000 without compounding, or simulate slashing to 950,000
3. Deployer calls change_validator, invoking redelegate_lp
4. Observe MsgBeginRedelegate sent with amount = pool.amount (1,000,000)
5. Rewards case: 50,000 left staked with old validator while pool.validator updates; slashing case: stargate call aborts
**How found:** Code review of redelegate_lp noticing it reads pool.amount (an internal counter updated only by add_stake/unstake/unlock_lp) rather than querying the mstaking module's actual delegation, then reasoning about reward accrual and slashing drift.
**Exploitation:** Requires deployer/admin action (change_validator). No attacker-controlled path; impact is operational: either the redelegation tx reverts (funds stuck with slashed validator) or partial redelegation leaves orphaned stake with the old validator while the pool record points to the new one.
**Insight:** When a contract caches a balance in its own state, compare it against the source-of-truth module for every operation that moves the full position; reward accrual and slashing are the classic drift sources in staking integrations.