# Users Might Not be Subject to Slashing Due to Slash Amount Updates in MevCommitMiddleware

Increasing slashAmount in MevCommitMiddleware reduces slashable validator count, letting a misbehaving validator escape slashing after an amount update.

- Payout: Contest reward
- Severity: medium
- Program: Primev
- Credited: amaron
- Disclosed: 2025-08-27
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.2.7
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.7
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic

**Target:** MevCommitMiddleware slashing logic (_updateSlashAmount / isValidatorSlashable)
**Root cause:** Number of slashable validators is computed as allocatedStake / slashAmount, so raising slashAmount after an infraction shrinks the slashable set and excludes the offending validator.
**Steps:**
1. Operator registers 3 validators, 10 tokens each, allocatedStake=30, slashAmount=10 -> getNumSlashableVals returns 3.
2. Third validator misbehaves.
3. Slash oracle/admin calls _updateSlashAmount(vault, 15).
4. getNumSlashableVals now returns 30/15=2.
5. slashValidators for the third validator fails require(_isValidatorSlashable(...)) since position 3 > 2.
**How found:** Code reading of _getNumSlashableVals division by slashAmount combined with sponsor note that _updateSlashAmount is called frequently due to token value fluctuations; reasoned about timing between infraction and slash.
**Exploitation:** A misbehaving validator avoids slashing if the slash amount is raised between its infraction and the slash transaction; the slash oracle's slashValidators call reverts with ValidatorNotSlashable.
**Insight:** When a slashable-set size is derived by dividing stake by a mutable parameter, check whether that parameter can change between infraction and enforcement, shrinking the set and excluding offenders.