# Slashing is not sufficient to prevent stealing of validator rewards

Attacker stakes 1 ETH on an honest validator's BLS pubkey in VanillaRegistry, becomes first-matched receiver in RewardManager, and claims proposer rewards exceeding the slashable stake.

- Payout: Contest reward
- Severity: high
- Program: Primev
- Credited: 0x18a6
- Disclosed: 2025-06-12
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_may2025.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_may2025%3A3.1.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic vuln:reward-distribution

**Target:** RewardManager.sol / VanillaRegistry staking and _findReceiver payout routing
**Root cause:** VanillaRegistry::stake does not validate BLS pubkey ownership, and RewardManager::_findReceiver returns the vanilla receiver before the EigenLayer receiver for the same pubkey. Slashing is capped at minStake (1 ETH), below typical MEV proposer rewards.
**Steps:**
1. Honest EigenLayer validator registers pubkey via AVS (mevCommitAVSTest.testRegisterValidatorsByPodOwners).
2. Attacker calls `vanillaRegistry.stake{value: 1 ether}([pubKey])` with the honest validator's pubkey; no ownership check, opt-in instant.
3. User calls `rewardManager.payProposer{value: 3 ether}(pubKey)`; `_findReceiver` returns the vanilla (attacker) receiver first.
4. Attacker calls `rewardManager.claimRewards()` and receives the full 3 ETH.
5. Net profit = reward - minStake (2 ETH); repeat per payment; slashing only recovers 1 ETH.
**How found:** Read docs noting BLS identity validation is deferred and slashing is the mitigation; reasoned that slashing assumes slash amount > attacker gain, then checked _findReceiver ordering and VanillaRegistry::stake ownership validation to find the profitable griefing variant.
**Exploitation:** Attacker front-runs or pre-registers the victim's BLS pubkey in VanillaRegistry by staking exactly minStake (1 ETH). Because _findReceiver checks vanilla receivers before EigenLayer receivers and returns on first match, all payProposer payments for that pubkey route to the attacker, who claims via claimRewards. Slashing caps loss at 1 ETH, so any reward above minStake is profitable.
**Escalation:** Repeatable across every applicable proposer payment; scales with number of victim pubkeys squatted and reward size.
**Insight:** When a protocol substitutes slashing for identity validation, compare the slashable stake against the maximum value routed through the identity; also check receiver-resolution ordering when multiple registries can claim the same key.