# Operators Cannot Recover Unslashed ETH After Full Slashing in beaconChainETHStrategy

Fully slashed EigenLayer operators hit a require(slashingFactor != 0) revert in increaseDelegatedShares, permanently locking post-slashing ETH deposits in their EigenPod.

- Payout: Contest reward
- Severity: medium
- Program: Eigenlayer
- Credited: elhaj
- Disclosed: 2025-07-08
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_eigenlayer_mar2025.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2025%3A3.2.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** beaconChainETHStrategy / DelegationManager share accounting
**Root cause:** _increaseDelegation reverts when slashingFactor==0, but recordBeaconChainETHBalanceUpdate always routes new beacon ETH through increaseDelegatedShares, so post-slashing deposits can never be proven/checkpointed.
**Steps:**
1. Operator is slashed 100% on beaconChainETHStrategy so slashingFactor becomes 0
2. Operator stakes 32 ETH to beacon deposit contract via EigenPod.stake
3. Operator calls verifyWithdrawalCredentials -> eigenPodManager.recordBeaconChainETHBalanceUpdate -> delegationManager.increaseDelegatedShares
4. _increaseDelegation hits `require(slashingFactor != 0, FullySlashed())` and reverts
5. Operator cannot undelegate (`require(!isOperator(staker))`), so ETH stays locked in EigenPod
**How found:** Code-reading of the deposit scaling factor mechanism (depositFactor = 1/slashingFactor) and tracing the verifyWithdrawalCredentials -> recordBeaconChainETHBalanceUpdate -> increaseDelegatedShares path, spotting the zero-factor require and the operator undelegation restriction.
**Exploitation:** Not an attacker-driven exploit; a design deadlock where a fully slashed operator's subsequent deposits become unrecoverable because every proof/checkpoint path reverts and undelegation is blocked for operators.
**Insight:** When a protocol uses a scaling factor to exempt post-slash deposits, check every code path that consumes that factor for division-by-zero or zero-guard reverts that block the exemption; also check whether the affected role can exit via the normal undelegate/withdraw path.