# External LST compromission leads to avs compromission due to a lack of operators' staked amount cooldown

Compromised external LST lets attacker mint, deposit, and register as AVS operator within two blocks, hijacking EigenDA quorums before protocol can pause.

- Payout: Contest reward
- Severity: medium
- Program: Eigenlayer
- Credited: zigtur
- Disclosed: 2024-04-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_eigenlayer_mar2024.pdf#3.2.1
- Library page: https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2024%3A3.2.1
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:governance

**Target:** DelegationManager/StrategyManager/RegistryCoordinator operator registration and deposit flow
**Root cause:** Operator registration and LST deposits have no cooldown or rate limit, so a compromised LST can be minted and deposited and the operator registered within a single block, immediately gaining AVS voting power.
**Steps:**
1. Compromise external LST (mint arbitrary tokens)
2. Call `StrategyManager.depositIntoStrategy()` with minted LST
3. If needed, call `DelegationManager.registerOperator()`
4. Call `RegistryCoordinator.registerOperator()` for a quorum using the LST
5. Participate in EigenDA offchain process; `EigenDAServiceManager.confirmBatch` accepts `block.number - 1` as reference, so within two blocks attacker has inflated shares and AVS power
**How found:** Code review of the deposit and operator registration paths noting absence of any cooldown/rate-limit, combined with reading `confirmBatch`'s use of `block.number - 1` to establish the two-block attack window.
**Exploitation:** Attacker with control of an external LST mints tokens, deposits them into the LST strategy to inflate shares, registers as operator and AVS operator in the same block, then submits batches to EigenDA using the inflated stake before the protocol can pause.
**Escalation:** Compromising one LST cascades to every AVS that uses that LST as a quorum stake source.
**Insight:** When a protocol trusts external yield-bearing tokens as stake, check whether stake acquisition and registration are atomic within a block; a two-block confirmation window is too short for governance pause, so rate-limiting deposits per block is the real mitigation.