# Malicious user can prevent other users from unbonding due to missing input validation

Babylon staking-api-service trusts user-supplied unbondingTxHash, letting an attacker squat a victim's staking tx hash in the DB and block their unbonding.

- Payout: Contest reward
- Severity: high
- Program: Babylon
- Credited: n4nika
- Disclosed: 2024-08-04
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_babylon_may2024.pdf#3.1.4
- Library page: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.1.4
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:high tech:rest technique:source-review vuln:business-logic vuln:dos

**Target:** staking-api-service /v1/unbonding endpoint and MongoDB unbonding collection
**Root cause:** The unbondingTxHash is user-provided and only format-checked, never verified against the submitted transaction; it is used as a unique DB key, so an attacker can pre-insert a victim's staking tx hash.
**Steps:**
1. Alice submits a staking tx; note its staking tx hash.
2. Eve creates her own valid staking tx and a signed unbonding tx for it.
3. Eve POSTs to `/v1/unbonding` with her unbonding payload but replaces `unbonding_tx_hash_hex` with Alice's staking tx hash.
4. DB insert succeeds since hash is unique and unvalidated.
5. Alice's later `/v1/unbonding` with the correct hash hits duplicate-key error and returns 403 Forbidden.
**How found:** Code review of UnbondDelegation/SaveUnbondingTx revealed the unbondingTxHash is only format-validated and used as a unique Mongo key, prompting the hypothesis that a hash could be squatted.
**Exploitation:** Attacker needs only the victim's public staking tx hash. They submit their own valid unbonding request but spoof the unbonding_tx_hash_hex field to the victim's staking tx hash, occupying the unique DB key so the victim's legitimate unbonding request is rejected as a duplicate.
**Insight:** When a user-supplied identifier becomes a unique DB key, check whether it is cross-validated against the object it names; unvalidated unique keys enable denial-of-service by key squatting on other users' public identifiers.