# An operator can evade slashing

MevCommitMiddleware checks operator's current stake instead of stake at infraction time, so an operator can opt out of Symbiotic services to zero their stake and revert pending slashes.

- Payout: Contest reward
- Severity: high
- Program: Primev
- Credited: trachev
- Disclosed: 2025-08-27
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic

**Target:** MevCommitMiddleware / Symbiotic BaseDelegator stake accounting
**Root cause:** _getNumSlashableVals divides the operator's current delegator.stake by slashAmount rather than stake at infractionTimestamp, so stake changes after the infraction affect slashability.
**Steps:**
1. Operator commits a slashable infraction while opted-in to OPERATOR_VAULT_OPT_IN_SERVICE and OPERATOR_NETWORK_OPT_IN_SERVICE.
2. Before oracle slashing is invoked (within slashPeriodSeconds), operator opts out of either Symbiotic opt-in service.
3. BaseDelegator.stake now returns 0 for the operator.
4. slashValidators calls _getNumSlashableRegisteredVals -> _getNumSlashableVals returns 0.
5. require(numSlashableRegistered != 0) reverts with ValidatorsNotSlashable, slash fails.
**How found:** Code review of slashValidators and _getNumSlashableVals; noticed stake is read at current timestamp rather than infractionTimestamp, then traced Symbiotic BaseDelegator.stake dependency on opt-in services to find a controllable zeroing path.
**Exploitation:** Operator waits for a slashable event, then front-runs the oracle slash transaction by opting out of a Symbiotic opt-in service (or having the network reduce their stake), zeroing current stake so the slash reverts and no funds are lost.
**Insight:** When a slashing/penalty check reads live stake or balance, look for any user-triggerable state transition (opt-out, withdrawal, delegation move) that zeroes it before the penalty tx lands; compare against the timestamp the offense is recorded at.