# Providers can guarantee themselves zero loss from slash by waiting to commit at last minute

Provider commits at decay end so residualBidPercentAfterDecay is ~0, making slash residualAmt and penaltyFee zero, escaping all slashing.

- Payout: Contest reward
- Severity: medium
- Program: Primev
- Credited: 0xrex
- Disclosed: 2025-08-27
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** mev-commit provider slash logic (preconf bid commitment)
**Root cause:** slash() computes residualAmt and penaltyFee as percentages of the decayed bid amount; when a provider commits at decayEndTimeStamp the decayed percent is ~0, so both residualAmt and penaltyFee resolve to zero.
**Steps:**
1. User A submits bid with 2 atomic txs for block 20914450; decayStartTimeStamp=123456, decayEndTimeStamp=123458 on mev-commit chain.
2. Provider waits until 123458 (decay end) to commit, so residualBidPercentAfterDecay ~ 0.
3. Block 20914450 is mined on Ethereum without the user's txs.
4. Bidder opens the commitment, triggering slash().
5. residualAmt = amt * residualBidPercentAfterDecay * PRECISION / PERCENT = 0; penaltyFee = residualAmt * feePercent * PRECISION / PERCENT = 0.
6. providerStakes[provider] -= 0; bidder receives 0; protocol earns no penalty fee.
**How found:** Code review of slash() showing residualAmt and penaltyFee are both derived multiplicatively from residualBidPercentAfterDecay, so a near-zero decay percent nullifies the entire slash; confirmed with a concrete decay-timestamp scenario.
**Exploitation:** Provider deliberately delays commitment until the decay window ends, ensuring the decayed bid percent is ~0. When the missed-inclusion slash executes, both the compensation to the bidder and the protocol penalty fee compute to zero, so the provider loses nothing while the user gets no compensation.
**Insight:** When a penalty is computed as a percentage of a value that itself decays over time, check whether the decay can be driven to zero before the penalty triggers, nullifying both compensation and protocol fee.