# `slash` calls can be blocked, allowing malicious users to bypass the slashing mechanism.

StakingModule's checkpointProtection modifier lets a user frontrun slash with stake(1) in the same block, blocking slashing until withdrawal delay passes.

- Payout: Contest reward
- Severity: medium
- Program: Telcoin
- Credited: Tricko
- Disclosed: 2023-02-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-telcoin-judging/issues/54
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-telcoin%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:race-condition

**Target:** StakingModule.sol staking/slashing contract
**Root cause:** checkpointProtection reverts any action when the account's last checkpoint blockNumber equals current block; slash internally calls _claimAndExit which carries this modifier, so a same-block stake makes slash revert.
**Steps:**
1. Bob calls `stake(1)` frontrunning Alice's `slash(bob,1,...)` in the same block, updating his checkpoint blockNumber.
2. Alice's `slash` executes, internally calls `_claimAndExit`, which hits `checkpointProtection` and reverts with 'Cannot exit in the same block as another stake or exit'.
3. Bob calls `requestWithdrawal()`, then keeps frontrunning every future `slash` with `stake(1)`.
4. After `withdrawalDelay` passes, Bob calls `exit`/`fullClaimAndExit` and withdraws funds that should have been slashed.
**How found:** Code reading of the checkpointProtection modifier and noticing slash routes through _claimAndExit, which is subject to the same-block checkpoint restriction.
**Exploitation:** Attacker monitors mempool for slash txs against their account, pays higher gas to frontrun each with a 1 TEL stake, sustaining the block until withdrawal delay elapses, then exits with full stake.
**Insight:** When a guard modifier is meant to protect user-initiated exits, check whether privileged/admin paths (like slash) reuse the same internal function and inherit the guard—an attacker can then weaponize the guard itself to block enforcement.