# Account that is affiliated with a plugin can sometimes evade slashing

A colluding plugin reverts requiresNotification() to block slash() on a staker, letting them withdraw stake before removal.

- Payout: Contest reward
- Severity: medium
- Program: Telcoin
- Credited: hyh
- Disclosed: 2023-02-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-telcoin-judging/issues/62
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-telcoin%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** StakingModule.sol staking contract plugin notification loop
**Root cause:** _notifyStakeChangeAllPlugins calls IPlugin(plugins[i]).requiresNotification() without try-catch, so a malicious plugin can revert and abort slash()/_claimAndExit().
**Steps:**
1. Plugin and account collude; account periodically calls `requestWithdrawal()` to keep a withdrawal window open.
2. SLASHER calls `slash(account, amount, to, auxData)`.
3. Plugin front-runs by setting state so `requiresNotification()` reverts, causing slash() to revert.
4. Plugin resets state to normal after the failed slash (sandwich).
5. SLASHER investigates with PLUGIN_EDITOR to identify/remove plugin.
6. Before removal, account's pre-requested withdrawal window arrives and `exit()` succeeds while plugin is in normal state.
**How found:** Code reading of _notifyStakeChangeAllPlugins: noticed requiresNotification() is called outside try-catch while notifyStakeChange is wrapped, so a reverting plugin aborts the whole slash flow.
**Exploitation:** Colluding plugin sandwiches the slashing tx with state toggles to revert requiresNotification(), stalling slashing until the staker's withdrawal window lets them exit with full stake.
**Insight:** When a loop wraps one external call in try-catch but not the preceding guard call (requiresNotification), the unguarded call is a griefing vector that can abort the entire privileged operation.