# Slashing penalty is unfairly paid by a subset of users if a deficit is accumulated.

When EigenPodManager podOwnerShares goes negative from slashing during a queued withdrawal, the first settling cohort absorbs the entire deficit, receiving 0 ETH.

- Payout: Contest reward
- Severity: medium
- Program: Rio Network Core Protocol
- Credited: monrel
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-rio-network-core-protocol-judging/issues/363
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:liquidation

**Target:** RioLRTWithdrawalQueue.settleEpochFromEigenLayer / EigenPodManager share accounting
**Root cause:** settleEpochFromEigenLayer measures assetsReceived as balance delta from completeQueuedWithdrawal; a negative podOwnerShares deficit zeroes out the first cohort's payout instead of being socialized across all LRT holders.
**Steps:**
1. Deposit to stake 2 validators (64 ETH shares).
2. requestWithdrawal(ETH, 8 ETH); rebalance for epoch 0.
3. requestWithdrawal(ETH, 31.99 ETH); rebalance for epoch 1.
4. Simulate slashing by setting `podOwnerShares[delegator] = -8 ether` via stdstore (equivalent to verifyBalanceUpdates decrease).
5. verifyAndProcessWithdrawalsForValidatorIndexes for both.
6. settleEpochFromEigenLayer(ETH, 0, withdrawals, ...) then claimWithdrawalsForEpoch(epoch 0) -> 0 ETH.
7. settleEpochFromEigenLayer(ETH, 1, ...) then claim epoch 1 -> 31.99 ETH (0% penalty).
**How found:** Code-read of settleEpochFromEigenLayer's balance-delta accounting combined with EigenLayer's EigenPodManager logic where podOwnerShares can go negative and be adjusted against the next withdrawal; hypothesized the deficit lands on whichever cohort settles first.
**Exploitation:** Attacker queues a small withdrawal in an early epoch and a large withdrawal in a later epoch; if a slashing deficit occurs while queued, the early cohort eats the full penalty while the later cohort (attacker) withdraws unaffected, extracting value from the first cohort.
**Insight:** When a protocol measures received assets as a balance delta around an external call, check whether that external system can report negative/owed balances — the delta then silently charges prior obligations to the current caller instead of amortizing them.