# Any undeposited Eth in Eigen Pod might incur any Slashing before they are deposited into the Eigen Pod Manager

ETH deposited directly into an EigenPod before checkpointing gets retroactively subjected to prior AVS-level slashing, reducing new depositors' withdrawable shares.

- Payout: Contest reward
- Severity: medium
- Program: Eigenlayer
- Credited: Aamirusmani1552
- Disclosed: 2025-07-08
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_eigenlayer_mar2025.pdf#3.2.1
- Library page: https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2025%3A3.2.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** EigenPodManager / EigenPod checkpoint accounting
**Root cause:** recordBeaconChainETHBalanceUpdate applies the existing AVS slashing factor to newly deposited pod balance because the deposit scaling factor is not updated for undeposited ETH before checkpointing.
**Steps:**
1. Deploy integration test extending Integration_DualSlashing_Base; expose delegationManager, strategyManager, eigenPodManager, timeMachine, beaconChain in User.t.sol
2. Add SlashType.Custom to BeaconChainMock and handle it in slashValidators
3. Staker deposits 128 ETH; AVS slashes operator 0.5 wad
4. Beacon chain slashes validators (Custom then Half); advance epoch, startCheckpoint/completeCheckpoint
5. Send 47 ETH directly to pod via `address(staker.pod()).call{value: 47 ether}("")`
6. startCheckpoint + completeCheckpoint; observe withdrawable shares = 47.5 ETH instead of 71 ETH, confirming AVS factor applied to new deposit
7. Repeat with deposit equal to slashed amount to hit zero balance delta; slashing still applies
**How found:** Code reading of _startCheckpoint and recordBeaconChainETHBalanceUpdate revealed that negative balance deltas apply the AVS slashing factor without distinguishing newly deposited ETH; confirmed via integration tests comparing expected vs actual withdrawable shares.
**Exploitation:** A staker who deposits fresh ETH into their EigenPod after prior AVS slashing events has that new ETH silently reduced by the historical AVS slashing factor when the next checkpoint is processed, causing direct loss of principal.
**Insight:** When auditing share-accounting systems, check whether slashing factors are applied to balances that arrived after the slashing event; test the boundary where new deposits exactly cancel the slashed delta, since that path bypasses both the positive and negative delta branches.