# Bidder will not get the penalty if the provider gets overslashed, and provider can manipu- late this to avoid paying the penalties

Provider can self-slash via fake commitments to drain own stake, leaving later bidders unpaid and avoiding penalties.

- Payout: Contest reward
- Severity: medium
- Program: Primev
- Credited: philmnds
- Disclosed: 2025-08-27
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.2.14
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.14
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** ProviderRegistry.sol slash() staking/slashing contract
**Root cause:** slash() caps payout at remaining stake; when total penalties exceed stake, later bidders get reduced or zero compensation, and provider can intentionally trigger this via fake commitments.
**Steps:**
1. Provider registers commitments to addresses they control (fake bids)
2. Provider fails to fulfill those commitments, accumulating slashing penalties >= stake
3. Call `slash()`; code path `if (providerStake < residualAmt + penaltyFee)` caps penaltyFee to `providerStake - residualAmt`
4. Remaining stake exhausted; subsequent legitimate bidders receive no penalty payout
**How found:** Code reading of slash() revealed the insufficient-funds branch caps penaltyFee at remaining stake, meaning penalties beyond stake are silently dropped; reasoned a provider could weaponize this by overslashing themselves.
**Exploitation:** Provider creates fake commitments to self-controlled addresses, intentionally defaults, exhausting stake via self-slashing so real bidders' penalties cannot be paid; provider escapes slashing cost.
**Insight:** In staking/slashing designs, check whether total outstanding penalties can exceed stake and whether the shortfall is socialized to later claimants; a provider can deliberately front-run the queue with self-slashable commitments to absorb their own stake before honest bidders claim.