# `validatorMaxStake` can be bypassed by using `setValidatorAddress()`

setValidatorAddress stacks old stake onto new address without checking validatorMaxStake, letting a validator exceed the max stake cap and earn excess rewards.

- Payout: Contest reward
- Severity: medium
- Program: Covalent
- Credited: Al-Qa-qa
- Disclosed: 2023-11-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-11-covalent-judging/issues/66
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-covalent%3AM-6
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** OperationalStaking.sol setValidatorAddress()
**Root cause:** setValidatorAddress adds the old address's shares/staked onto the new address's existing staking without validating the combined total against validatorMaxStake.
**Steps:**
1. Bob self-stakes up to validatorMaxStake on validator address B.
2. Bob controls B2 which already has stake delegated to Bob's validator.
3. Bob calls `setValidatorAddress(validatorId, B2)` from B; shares/staked are summed onto B2 with no max check.
4. B2 now exceeds validatorMaxStake; repeat migration to B3, B4 to keep stacking.
**How found:** Code review of setValidatorAddress noticed the stake is simply summed onto the new address with no validatorMaxStake check, breaking the cap invariant.
**Exploitation:** Validator migrates stake between controlled addresses to accumulate stake above validatorMaxStake, increasing reward share and raising max delegator cap via (validator stake)*maxCapMultiplier; can front-run a freeze with an unstake.
**Escalation:** Repeated migrations across multiple controlled addresses compound the over-cap stake; front-running admin freeze with unstake preserves funds.
**Insight:** When a function moves/merges balances between accounts, check every cap/invariant against the post-merge total, not just the source; migration and merge paths are common places caps get skipped.