# when a validator is kicked out of the bonded validator set ,unstake funds will remain in the contract

When a Cosmos validator is jailed/tombstoned, x/staking auto-unbonds delegations directly to the andromeda-validator-staking contract, bypassing the UNSTAKING_QUEUE so funds stay locked.

- Payout: Contest reward
- Severity: medium
- Program: Andromeda Ado
- Credited: J4X_
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-andromeda-ado-judging/issues/41
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** CosmWasm andromeda-validator-staking contract
**Root cause:** The contract only tracks withdrawals via UNSTAKING_QUEUE pushed in execute_unstake; validator-initiated auto-unbonding (jailing/tombstoning) sends funds to the contract without a queue entry, so execute_withdraw_fund never releases them.
**Steps:**
1. Call `execute_unstake(100)` -> `UNSTAKING_QUEUE.push_back(100)`
2. Wait UnbondingTime; `x/staking` transfers funds to the contract
3. Call `execute_withdraw_fund()` -> `UNSTAKING_QUEUE.pop_front(100)` and transfer to sender
4. Instead: validator moves Bonded->Unbonding (jailed/slashed/tombstoned); x/staking auto-unbonds all delegations and sends tokens directly to the contract
5. No queue entry exists, so `execute_withdraw_fund` cannot release those funds
**How found:** Code-reading of the unstake/withdraw flow against Cosmos SDK staking semantics: noticed the only path to withdraw is the UNSTAKING_QUEUE, but the SDK auto-unbonds delegations on validator removal without going through execute_unstake.
**Insight:** When auditing staking wrappers, enumerate every way the underlying staking module can move tokens into the contract (jailing, tombstoning, slashing, redelegation) and check each has a corresponding accounting/withdraw path, not just the user-initiated one.