# Stakers can avoid validator penalties

Stakers front-run validator slashing by requesting withdrawal before EigenPod balance update, locking in pre-slash exchange rate and shifting losses onto remaining stakers.

- Payout: Contest reward
- Severity: medium
- Program: Rio Network Core Protocol
- Credited: monrel
- Disclosed: 2024-02-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-rio-network-core-protocol-judging/issues/190
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-7
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:race-window vuln:business-logic vuln:oracle-manipulation

**Target:** RioLRTCoordinator / EigenPod share accounting
**Root cause:** Withdrawal share amounts (sharesOwed) are computed at request time from current TVL, so a withdrawal requested before EigenPod::verifyBalanceUpdates/verifyAndProcessWithdrawals reflects the pre-slash rate; the later TVL drop is not applied to already-queued withdrawals.
**Steps:**
1. Deposit ETH so deposit pool holds liquidity (e.g. 10 ETH idle).
2. Call `RioLRTCoordinator.requestWithdrawal(ETH_ADDRESS, amount)` to lock in sharesOwed at pre-slash rate.
3. Trigger/observe `EigenPod::verifyBalanceUpdates()` or `verifyAndProcessWithdrawals()` dropping podOwnerShares and TVL.
4. Wait `rebalanceDelay()`, call `rebalance(ETH_ADDRESS)` to queue withdrawal at old rate.
5. Call `withdrawalQueue.claimWithdrawalsForEpoch(...)` to receive full amount, avoiding the penalty.
**How found:** Researcher traced that EigenPod::verifyBalanceUpdates and verifyAndProcessWithdrawals instantly reduce podOwnerShares/TVL, then reasoned that withdrawal share amounts are fixed at request time, making the drop avoidable by front-running.
**Exploitation:** Attacker monitors for slashing/penalty events, immediately requests withdrawal of all LRT tokens while deposit pool has liquidity, then lets the permissionless EigenPod balance update drop TVL; rebalance settles their withdrawal at the pre-drop exchange rate, so they avoid the loss while remaining stakers absorb it.
**Escalation:** If many stakers front-run, the slashing cost concentrates on non-front-runners; a 1 ETH slash with 31/32 ETH front-running leaves the last cohort with 0 shares (100% loss) instead of ~3%.
**Insight:** In LRT/LST share accounting, check whether exchange rate is locked at withdrawal-request time vs settlement time; any permissionless TVL-reducing oracle update (slashing, balance verification) creates a front-run window where requesters dodge the loss and shift it to others.