# Changes of the `UnbondingTime` are not accounted for

Unstaking queue assumed monotonically increasing payout times; a governance reduction of UnbondingTime lets a newer entry block older withdrawals, locking funds up to weeks.

- Payout: Contest reward
- Severity: medium
- Program: Andromeda Ado
- Credited: J4X_
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-andromeda-ado-judging/issues/54
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-12
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:incomplete-fix technique:source-review vuln:business-logic vuln:dos

**Target:** CosmWasm validator-staking contract (execute_withdraw_fund / UNSTAKING_QUEUE)
**Root cause:** Withdrawal loop breaks at the first queue entry whose payout_at is in the future, assuming FIFO ordering by completion time; governance lowering x/staking UnbondingTime makes later entries expire earlier than earlier ones, violating that invariant.
**Steps:**
1. Owner calls `execute_unstake()`; reply handler `on_validator_unstake` pushes `UnstakingTokens{fund, payout_at}` from the staking event's `completion_time` onto `UNSTAKING_QUEUE`.
2. Governance submits `MsgUpdateParams` reducing x/staking `UnbondingTime` (e.g. 21d -> 7d) while entries are queued.
3. New unstake entry gets a shorter payout_at than the older head entry.
4. Call `execute_withdraw_fund()`: loop sees head `payout_at > env.block.time` and breaks, so the already-expired newer entry cannot be popped until the older head expires.
**How found:** Code-reading of the withdrawal loop revealed an implicit monotonic-ordering assumption on payout_at; the researcher then checked Cosmos x/staking params and confirmed UnbondingTime is governance-mutable, and compared real chain unbonding times to argue a 1-2 week reduction is plausible.
**Insight:** When a queue is drained by breaking on a time/ordering predicate, check whether the external source of that timestamp (chain params, oracle, config) can change and break the assumed monotonicity; governance-mutable Cosmos module params are a recurring source of such invariant breaks.