# No cooldown in `recoverUnstaking()`, opens up several possible attacks by abusing this functionality.

recoverUnstaking() in Covalent's OperationalStaking lacks a cooldown, letting an attacker repeatedly restake to grief validators or front-run reward distribution.

- Payout: Contest reward
- Severity: medium
- Program: Covalent
- Credited: PUSH0
- Disclosed: 2023-11-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-11-covalent-judging/issues/52
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-covalent%3AM-5
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** OperationalStaking.sol staking contract (recoverUnstaking)
**Root cause:** recoverUnstaking() re-stakes an unstaking amount to the same validator with no cooldown, unlike the 28-day unstaking withdrawal cooldown, so users can freely toggle stake state at will.
**Steps:**
1. Attacker stakes up to `staked * maxCapMultiplier` to target validator, then immediately unstakes.
2. When a victim stakes, attacker front-runs with `recoverUnstaking()` to re-stake max amount, filling the cap so victim's stake tx reverts.
3. Attacker unstakes again, repeating as needed to deny delegators.
4. For reward theft: stake then unstake, front-run `rewardValidators()` with `recoverUnstaking()` to capture mid-epoch rewards, then unstake.
**How found:** Code review of OperationalStaking.sol noting the unstaking cooldown applies only to withdrawal, not to recoverUnstaking(), then reasoning about griefing and front-running vectors.
**Exploitation:** Attacker with large capital cycles stake/unstake and uses recoverUnstaking() to front-run victim stakes (denial) or rewardValidators() calls (reward theft), while keeping funds in unstaking state to bypass freezing and de-risk.
**Escalation:** Combined with a separate mid-epoch reward distribution flaw to steal rewards; keeping funds unstaking also bypasses validator freezing.
**Insight:** When a protocol enforces a cooldown on one state transition (withdraw), check whether the inverse transition (recover/restake) is also rate-limited; asymmetric cooldowns enable griefing and front-running of cap-limited or reward-triggering functions.