# Buffer Silently Locks Staked HYPE in Contract Without Using Them For Withdrawals Or Providing A Way To Be Pulled Out Or Moved To L1

Cancelling a queued withdrawal in Kinetiq's StakingManager never restores the HYPE buffer, so redelegation sends unbacked funds to L1 and locks HYPE in the contract.

- Payout: Contest reward
- Severity: high
- Program: Kinetiq
- Credited: franfran20
- Disclosed: 2025-07-07
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-04-kinetiq#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StakingManager.sol withdrawal buffer accounting
**Root cause:** cancelWithdrawal decrements totalQueuedWithdrawals and tracks _cancelledWithdrawalAmount but never re-increments hypeBuffer, so redelegateWithdrawnHYPE moves HYPE to L1 that was already consumed from the buffer, leaving the contract's spot balance short.
**Steps:**
1. User stakes HYPE, receives kHYPE; buffer target 30, current buffer 20.
2. User queues withdrawal of 15 HYPE; _withdrawFromValidator UserWithdrawal path takes 15 from buffer (buffer→5) and returns early without touching L1.
3. During delay, manager calls `cancelWithdrawal(user, id)`: kHYPE returned, `_cancelledWithdrawalAmount += 15`, buffer stays 5.
4. Manager calls `redelegateWithdrawnHYPE()`: `_distributeStake(15, SpotDeposit)` → `sendCDeposit` + RebalanceDeposit to L1.
5. The 15 HYPE was never moved to L1 spot balance, so the deposit is unbacked and HYPE is stranded in the StakingManager contract.
6. Repeat cancel/redelegate cycles to accumulate locked HYPE.
**How found:** Code-reading of the UserWithdrawal buffer branch, cancelWithdrawal, and redelegateWithdrawnHYPE; noticed cancel path never restores hypeBuffer while redelegate assumes funds sit in spot balance on L1.
**Exploitation:** Requires MANAGER_ROLE to call cancelWithdrawal and redelegateWithdrawnHYPE; each cancel-then-redelegate cycle strands the buffer-sourced amount in the contract while crediting L1 staking balance, draining the buffer accounting.
**Escalation:** Repeated cycles compound the locked amount and progressively desync buffer accounting from actual L1 backing.
**Insight:** When a buffer/accounting variable is decremented on one path (withdrawal) and a separate cancel path reverses the user-facing state, check whether the internal accounting variable is symmetrically restored; asymmetric reversal creates phantom balances that later flows spend.