# Bidder can lock provider stake and payout forever by not accepting ether

Malicious bidder rejects ETH refund in BidderRegistry/ProviderRegistry, reverting commitment processing and permanently locking provider stake and payout.

- Payout: Contest reward
- Severity: high
- Program: Primev
- Credited: philmnds
- Disclosed: 2025-08-27
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.1.8
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.8
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** BidderRegistry/ProviderRegistry smart contracts
**Root cause:** retrieveFunds() and slash() push ETH to the bidder via call{value:} and require success; a bidder that reverts the transfer reverts the whole commitment-processing chain, so commitmentsCount is never decremented and stake stays locked.
**Steps:**
1. Bidder registers a bid and a provider completes a commitment.
2. Commitment is processed via Oracle::processBuilderCommitmentForBlockNumber -> _processCommittment -> PreconfManager::initiateReward or initiateSlash.
3. BidderRegistry::retrieveFunds() (or ProviderRegistry::slash()) executes `payable(bidder).call{value: fundsToReturn}("")` with `require(success, ...)`.
4. Bidder's contract reverts on receiving ETH, so the call fails and the require reverts the entire transaction.
5. Provider's commitmentsCount is never reduced; stake and payout remain locked indefinitely.
**How found:** Code review of the reward and slash call chains; noticed the external ETH push with require(success) in retrieveFunds() and slash() and reasoned that a reverting receiver would roll back the commitment state update that unlocks provider stake.
**Exploitation:** Malicious bidder deploys a contract that reverts on ETH receipt, wins/participates in a commitment, then blocks refund/slash transfers so the reward or slash path always reverts, freezing the provider's stake and payout.
**Insight:** In commitment/settlement flows, any push-payment with require(success) to a counterparty lets that counterparty grief the state transition; check whether the same transaction also performs the accounting that unlocks other users' funds.