# Withdrawal Transaction Output Value can Go Below Dust Limit and Negative

Babylon btc-staking-ts validates withdrawal output against dust limit before subtracting fee, allowing output below dust or negative value.

- Payout: Contest reward
- Severity: medium
- Program: Babylon
- Credited: Topmark
- Disclosed: 2024-08-04
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_babylon_may2024.pdf#3.2.11
- Library page: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.11
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:solidity vuln:accounting-error vuln:business-logic

**Target:** btc-staking-ts withdrawalTransaction PSBT builder
**Root cause:** Dust-limit check runs on the raw output value before estimatedFee is subtracted, so the final added output can fall below BTC_DUST_SAT or become negative.
**Steps:**
1. Call `withdrawalTransaction` with a tx whose `tx.outs[outputIndex].value` is >= BTC_DUST_SAT but less than BTC_DUST_SAT + estimatedFee.
2. Observe the pre-subtraction dust check passes.
3. `psbt.addOutput` receives `value - estimatedFee`, which is below dust or negative.
4. Resulting PSBT is invalid / breaks protocol functionality.
**How found:** Code reading of withdrawalTransaction: noticed the dust check uses outputValue before estimatedFee is subtracted later in addOutput, so the guard does not cover the final value.
**Insight:** When a value is validated then later adjusted by a fee/subtraction, check whether the guard runs on the pre-adjustment value; dust/balance checks must apply to the final output.