# Malicious operators can `undelegate` theirselves to manipulate the LRT exchange rate

A malicious Rio operator can call EigenLayer's undelegate on its own delegator, zeroing EigenPod shares and crashing the LRT exchange rate while stranding ETH.

- Payout: Contest reward
- Severity: high
- Program: Rio Network Core Protocol
- Credited: g
- Disclosed: 2024-02-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-rio-network-core-protocol-judging/issues/53
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** EigenLayer DelegationManager / RioLRTOperatorDelegator
**Root cause:** Rio's TVL accounting reads EigenPod shares from EigenLayer; when an operator undelegates its delegator, EigenLayer removes those EigenPod shares, so Rio's TVL and LRT exchange rate drop without any corresponding asset movement.
**Steps:**
1. Deposit ETH via `reETH.coordinator.depositETH{value: 160 ether}()` and `rebalance(ETH_ADDRESS)` to push funds into EigenLayer.
2. Verify validator credentials so 5 validators (32 ETH each) are attributed to the operator's EigenPod; `getEigenPodShares()` returns 160e18 and TVL is 160.01e18.
3. As the operator, call `delegationManager.undelegate(operatorDelegator)`.
4. Observe `getEigenPodShares()` returns 0 and `getTVLForAsset(ETH_ADDRESS)` drops to 0.01e18, collapsing the LRT exchange rate.
**How found:** Code-reading of EigenLayer's `DelegationManager.undelegate` against Rio's TVL accounting: noticed Rio derives ETH TVL from EigenPod shares, and that undelegation zeroes those shares while the staker (Rio delegator) has no withdrawal path.
**Exploitation:** A registered operator (voted into the active operator set) calls EigenLayer's `undelegate` on its own Rio delegator contract. EigenPod shares are wiped from Rio's accounting, TVL collapses, LRT exchange rate drops; queued strategy-share withdrawals land at the delegator contract which lacks withdrawal logic, so ETH/LST becomes stuck and unclaimable by the Rio Delegator Approver.
**Insight:** When a protocol derives TVL/exchange rate from an external protocol's share accounting, check every external state transition that can zero or move those shares (undelegate, slashing, withdrawal queue) and whether the protocol's own contracts can reclaim the assets afterward.