# Delayed staking transaction will not be unbondable, letting staker's funds locked for a long period

Babylon staking tx valid under old params but mined after a param change is rejected by the indexer, so it can never be unbonded and funds stay locked until timelock expiry.

- Payout: Contest reward
- Severity: medium
- Program: Babylon
- Credited: zigtur
- Disclosed: 2024-08-04
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_babylon_may2024.pdf#3.2.10
- Library page: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.10
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Bitcoin staking indexer / unbonding service (unbonding.go, validateStakingTx)
**Root cause:** Staking tx validity is checked against the GlobalParams active at inclusion height, not at creation; params are upgradeable with no backward compatibility, so a tx valid at block N is rejected at N+1.
**Steps:**
1. Staker builds staking tx at block N using current MinStakingAmount/MaxStakingAmount/MinStakingTime/MaxStakingTime.
2. Params change at block N+1 (new start height).
3. Tx is mined at N+1; `validateStakingTx` compares against new params and returns ErrInvalidStakingTx.
4. Tx is not indexed, so no delegation record exists.
5. Call `UnbondDelegation` with the staking tx hash; `FindDelegationByTxHashHex` returns not-found and the request fails with 403 'delegation not found'.
6. Funds remain locked until the staking timelock expires.
**How found:** Code review of unbonding.go and the indexer's validateStakingTx: noticed validity is evaluated at inclusion height while params are height-scoped and upgradeable, then traced that non-indexed txs have no delegation record and thus fail the unbonding lookup.
**Exploitation:** Not an attacker-driven exploit: a benign staker whose tx is delayed past a parameter change loses unbonding ability; only recourse is contacting covenant emulation committee members for signatures or waiting out the timelock.
**Insight:** When a protocol validates objects against height-scoped, upgradeable parameters, check the gap between object creation and inclusion height — any object accepted under old params but rejected under new ones becomes unprocessable by downstream state (here, unindexed and therefore unbondable).