# All operators can have ETH deposits regardless of the cap setted for them leading to miscalculated TVL

Operators without a BEACON_CHAIN_STRATEGY cap can still stake ETH and verify withdrawal credentials, inflating TVL since getETHBalanceInEigenLayer loops all operators.

- Payout: Contest reward
- Severity: medium
- Program: Rio Network Core Protocol
- Credited: hash
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-rio-network-core-protocol-judging/issues/235
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-8
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LRT asset registry / operator delegator (EigenLayer restaking)
**Root cause:** getETHBalanceInEigenLayer iterates every operator ID and sums getETHUnderManagement, but operators outside the BEACON_CHAIN_STRATEGY heap can still stake ETH and call verifyWithdrawalCredentials to accrue EigenPod shares, so their balances are counted in TVL despite being unreachable for deposits/withdrawals.
**Steps:**
1. Operator not in BEACON_CHAIN_STRATEGY heap (no validator cap) stakes ETH to beacon chain directly, bypassing EigenPod stake()
2. Operator's delegator calls `verifyWithdrawalCredentials` to increase EigenPod shares and reduce queued ETH
3. `getTVLForAsset(ETH_ADDRESS)` -> `getETHBalanceInEigenLayer` loops `id = 1..operatorCount()` summing `getETHUnderManagement()` for all operators
4. Uncapped operator's EigenPod shares are included in TVL, inflating exchange rate and reported ETH holdings
**How found:** Code reading of the TVL loop in AssetRegistry against the EigenLayer EigenPod flow: noticed the loop covers all operators rather than only those in the BEACON_CHAIN_STRATEGY heap, then confirmed operators can stake and verify credentials independently of the cap.
**Exploitation:** No direct theft; the misaccounting inflates LRT TVL/exchange rate and can cause withdrawals to fail because counted ETH is not in the active heap.
**Insight:** When a protocol aggregates balances by iterating all registered entities, check whether entities outside the active/eligible set can still accrue the tracked asset via an external contract (here EigenPod) that bypasses the protocol's own stake path.