# staking-indexer does not handle one transaction spending an expired unbonding and stak- ing transaction properly

Babylon staking-indexer's early continue skips unbonding-spend handling when one tx spends both a staking and unbonding output, leaving unbonding state stuck un-withdrawn.

- Payout: Contest reward
- Severity: high
- Program: Babylon
- Credited: n4nika
- Disclosed: 2024-08-04
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_babylon_may2024.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.1.3
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:go technique:source-review vuln:accounting-error vuln:business-logic

**Target:** staking-indexer HandleConfirmedBlock transaction parsing
**Root cause:** In HandleConfirmedBlock, after getSpentStakingTx matches, the code `continue`s before getSpentUnbondingTx runs, so a single tx spending both a staking and an unbonding output never triggers handleSpendingUnbondingTransaction.
**Steps:**
1. Stake twice, unbond one staking tx, let both timelocks expire.
2. Build one withdrawal tx with two inputs: one spending the staking output, one spending the unbonding output.
3. Submit to BTC; indexer processes tx in HandleConfirmedBlock.
4. getSpentStakingTx returns >=0, handleSpendingStakingTransaction runs, then `continue` at [1] skips getSpentUnbondingTx.
5. Observe staking tx marked withdrawn via WithdrawStakingHandler but unbonding tx state never transitions to withdrawn.
**How found:** Code-reading of HandleConfirmedBlock control flow: noticed the `continue` after the staking-spend branch and reasoned that a multi-input tx could spend both a staking and unbonding output, since withdrawal txs have no input/output restrictions after timelock expiry.
**Insight:** When an indexer dispatches per-input-type handlers with early `continue`, check whether a single transaction can match multiple input categories; Bitcoin txs are multi-input, so combined spends bypass later branches.