## Description The staking system allows users to unstake their tokens through a multi-step process: 1. User triggers initiate unstake by `initiateUnstake()`. This changes the `stakerState[user] = StakerState.UnstakeInitiated`. 2. User triggers claim unstake by `claimUnstake()`. This changes the `stakerState[user] = StakerState.UnstakeClaimed`. 3. Event-forwarder detects `Unbonded` events on SXT chain forward to EVM, calling `sxtFulfillUnstake()`. This step releases the SXT tokens to user. The event-forwarder must pass merkle proofs when calling `sxtFulfillUnstake()`. The signed message is a ``, where the `state_root` is a merkle root hash of the amount of SXT each account locked at `block_number`. This means if we find `` is in the merkle tree, we can correctly expect that `staker` has an `amount` of SXT locked up at block `sxtBlockNumber`. The bug here is made of two parts: 1. The merkle root hash does NOT contain unbond events. 2. `sxtFulfillUnstake` can be called by anyone. Since SXT chain is public, anyone can figure out the correct `` message for each block. They can also find the signature of the message signed by attestor, since it is stored directly on chain in attestation pallet's `Attesation` storage. Now, let's see the attack scenario: 1. Alice stakes 100 SXT tokens at block 10. 2. Alice triggers `initiateUnstake()` and `claimUnstake()` at block 15. The `state_root` for block 11 to 15 contains a locked entry of ``. 3. Before event-forwarder detects the `Unbonded()` event, Alice calls `sxtFulfillUnstake()` with `sxtBlockNumber = 11`. Since the `state_root` of block 11 contains ``, 100 SXT will be released to Alice. 4. Alice quickly stakes another 10 SXT and unstakes at block 16. 5. Alice calls `sxtFulfillUnstake()` with `sxtBlockNumber = 12`. Since the `state_root` of block 12 contains ``, another 100 SXT will be released to Alice. In the end, Alice ends up with 200 SXT when only staking 110 SXT. The pre-requirements for this attack is Alice must act quick before the event-forwarder calls `sxtFulfillUnstake()` with `sxtBlockNumber = 15` on step 3. This can happen if either: 1. The `UNSTAKING_UNBONDING_PERIOD` is short 2. The event-forwarder is down (which should prevent unbonding but doesn't) Code for Attestation storage on SXT chain: https://cantina.xyz/code/3cc30b66-1cba-4044-968f-a0817cd7bf83/sxt-node/pallets/attestation/src/lib.rs?lines=95,95 ```rust pub enum Attestation { /// An Ethereum-style attestation. #[serde(rename_all = "camelCase")] EthereumAttestation { /// The signature. signature: EthereumSignature, /// The public key used to sign the attestation. #[serde(serialize_with = "serialize_bytes_hex")] proposed_pub_key: [u8; 33], /// The ethereum address for this public key #[serde(serialize_with = "serialize_bytes_hex")] address20: Address20, /// The state root included in the attestation. #[serde(serialize_with = "serialize_bytes_hex")] state_root: AttestationStateRoot, /// The block number that was attested block_number: u32, /// The hash of the block that was attested block_hash: BH, }, } #[pallet::storage] #[pallet::getter(fn attestations)] pub type Attestations = StorageMap< _, Blake2_128Concat, BlockNumber, BoundedVec, ConstU32<64>>, ValueQuery, >; ``` Code for `Staking.sol` on EVM: https://cantina.xyz/code/3cc30b66-1cba-4044-968f-a0817cd7bf83/sxt-node-op-contracts/src/Staking.sol?lines=181,181 ```solidity // @inheritdoc IStaking function sxtFulfillUnstake( address staker, uint248 amount, uint64 sxtBlockNumber, bytes32[] calldata proof, bytes32[] calldata r, bytes32[] calldata s, uint8[] calldata v ) external requireState(staker, StakerState.UnstakeClaimed) whenNotPaused { // solhint-disable-next-line gas-strict-inequalities if (latestSxtBlockFulfillmentByStaker[staker] >= sxtBlockNumber) revert InvalidSxtBlockNumber(); // Validate signature if (!_validateSxtFulfillUnstake(staker, amount, sxtBlockNumber, proof, r, s, v)) revert InvalidSignature(); // State changes first (Effects) latestSxtBlockFulfillmentByStaker[staker] = sxtBlockNumber; initiateUnstakeRequestsTimestamp[staker] = 0; stakerState[staker] = StakerState.Unstaked; // Event emission before external calls emit Unstaked(staker, amount); // External interactions last - direct withdraw to staker IStakingPool(STAKING_POOL_ADDRESS).withdraw(staker, amount); } ``` Code for generation of merkle tree `state_root` hash: https://cantina.xyz/code/3cc30b66-1cba-4044-968f-a0817cd7bf83/sxt-node/event-forwarder/src/event_forwarder.rs?lines=247,262 ```rust let (commitments, locks_staking, contract_info) = attestation::fetch::commitments_and_locks_and_staking_contract_info( api, attested_block.hash(), ) .await .context(FetchCommitmentsAndAccountsSnafu)?; let tree = attestation_tree_from_prefixes::<_, _, Runtime>( commitments, locks_staking, contract_info.clone(), ) .context(ConstructingMerkleTreeSnafu)?; let state_root = extract_state_root(&tree)?; ``` ## Impact Attackers can double-claim their unstaked tokens by manipulating state root proofs. The likelihood is medium (depends on unbonding period and event-forwarder status), impact is high, hence reported as high severity. ## Recommendation Add access control to `sxtFulfillUnstake()` function, or add `Unbonded` events to merkle tree hash.

Competition	Date	Submissions	Payout
Morpho	Jul 15, 2025	2	$3,150
Space and Time	May 2, 2025	32	$12,888
Eigenlayer	Mar 7, 2025	2	$0
Bima	Dec 2, 2024	18	$42,302
Sorella Labs	Nov 11, 2024	4	$9,640
Panoptic	Oct 11, 2024	2	$2,000
StakeUp	Oct 7, 2024	10	$2,798
Uniswap Labs	Sep 6, 2024	12	$10,000
ZetaChain	Aug 19, 2024	7	$315

pkqs90

Public reviews