# Withdraw delay can be bypassed

Telcoin StakingModule lets users call requestWithdrawal before staking, so the withdrawal delay can be bypassed and stake exited immediately.

- Payout: Contest reward
- Severity: medium
- Program: Telcoin
- Credited: banditx0x
- Disclosed: 2023-02-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-telcoin-judging/issues/23
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-telcoin%3AM-5
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** StakingModule staking/withdrawal contract
**Root cause:** withdrawalRequestTimestamps is set independently of stake balance; no relationship enforced between staking and the withdrawal request, so a pre-staked request timestamp satisfies the delay check.
**Steps:**
1. Call `requestWithdrawal()` with zero stake to record `withdrawalRequestTimestamps`.
2. Wait `withdrawalDelay` seconds via `helpers.time.increase(delay)`.
3. Call `stake(bobAmtStake)` to acquire stake.
4. Immediately call `fullClaimAndExit(emptyBytes)` within the withdrawal window, bypassing the delay.
**How found:** Code review of requestWithdrawal/stake logic noting the timestamp is not tied to stake amount; even a `staked > 0` check is bypassable by staking 1 wei.
**Exploitation:** Attacker pre-registers a withdrawal request before staking, waits out the delay once, then can stake and exit instantly without locking funds for the delay period.
**Insight:** When a time-lock is keyed to a request timestamp, check whether the request can be created before the asset is committed; a `staked > 0` guard is insufficient if the timestamp isn't reset on stake.