# Queued withdrawals can become uncompleteable due to reverts causing funds to be lost

EigenLayer queued withdrawals mixing beacon-chain shares with slashed tokens can revert in both receiveAsTokens and addShares paths, permanently locking funds.

- Payout: Contest reward
- Severity: medium
- Program: Eigenlayer
- Credited: hash
- Disclosed: 2025-07-08
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_eigenlayer_mar2025.pdf#3.2.3
- Library page: https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2025%3A3.2.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** DelegationManager._completeQueuedWithdrawal
**Root cause:** A single receiveAsTokens mode applies to all tokens in a withdrawal; beacon-chain negative shares require addShares, but addShares reverts via _increaseDelegation when any queued token's newSlashingFactor is zero, and withdrawSharesAsTokens reverts for negative beacon shares.
**Steps:**
1. Queue withdrawal for [beacon, usdc, pepe] with amounts [1e2, 1e6, 1e2]
2. Set podOwnerDepositShares=0 and restakedExecutionLayerGwei=0
3. Trigger beacon-chain slashing so podOwnerDepositShares becomes -1
4. After MIN_WITHDRAWAL_DELAY_BLOCKS, pepe slashed 100% so newSlashingFactor==0
5. Call completeQueuedWithdrawal with receiveAsTokens=true -> beacon withdrawSharesAsTokens reverts
6. Call with receiveAsTokens=false -> _increaseDelegation reverts on zero slashingFactor
**How found:** Code reading of _completeQueuedWithdrawal noting single receiveAsTokens mode for all tokens, combined with the beacon-chain negative-share constraint and the zero newSlashingFactor revert in _increaseDelegation.
**Exploitation:** Operator cannot undelegate to escape the zero-slashing-factor state (only stakers can), so the queued withdrawal is stuck in both modes and funds are lost.
**Insight:** When a batch operation applies one mode flag across heterogeneous assets, check each asset's per-item preconditions against both branches; a revert in either branch for any single item bricks the whole batch.