Kinetiq deactivateValidator leaves 1,000 HYPE on the validator

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 58610-h-02-validatormanager-missing-fund-withdrawal-from-validator. Standalone Foundry PoC and full write-up: 58610-h-02-validatormanager-missing-fund-withdrawal-from-validator_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/dos/frozen-funds · vuln/logic/missing-check

Key info#

Field	Value
Loss	1,000 HYPE stays on the validator. The control pays 1,000 to the staking manager
Vulnerable contract	`StakingManager.deactivateValidator`
Attacker EOA	`0x1111111111111111111111111111111111111111`
Attack contract	`Exploit`
Attack tx	`Exploit.run()`
Chain / block / date	Ethereum model · block 0 · 2025-02
Compiler	solc 0.8.27, cancun, via IR
Bug class	Deactivate records a request and never withdraws

TL;DR#

deactivateValidator stores a rebalance request for the validator's balance and sets active to false. It never calls processValidatorWithdrawals. After deactivating a validator that holds 1,000 HYPE, the validator still holds 1,000 and the staking manager holds 0. The control calls the withdraw in the same function and the manager receives 1,000.

The vulnerable code#

SOLIDITY

if (bal > 0) {
    // @> VULN: a rebalance request is stored and the validator balance is never withdrawn.
    requested = bal;
}
active = false;

The control then calls processValidatorWithdrawals, which pushes the balance to the manager.

Root cause#

The withdrawal request is only an accounting record. The HYPE sits on the validator account. Later closes of that request need the tokens to already be in the staking manager, and they revert because the manager balance is still zero.

Attack walkthrough#

The validator is funded with 1,000 HYPE.
deactivateValidator sets requested to 1,000 and clears active.
No transfer runs. The validator balance is still 1,000. The manager balance is 0.
The control manager deactivates and calls processValidatorWithdrawals.
The control validator pushes 1,000 HYPE to its manager and ends at 0.

Diagrams#

flowchart TD A["Validator holds 1000 HYPE"] --> B["deactivateValidator stores a request"] B --> C["active is set false"] C --> D["No withdraw runs"] D --> E["1000 HYPE stays on the validator"] E --> F["Control processValidatorWithdrawals pays 1000 to the manager"]

Impact#

1,000 HYPE is stuck on the deactivated validator. The staking manager cannot complete the rebalance it just recorded. The control path delivers that 1,000 to the manager.

PoC#

BASH

cd 58610-h-02-validatormanager-missing-fund-withdrawal-from-validator_exp
forge test -vv

test_exploit_deactivate_leaves_1000 asserts the validator still holds 1,000e18, the manager received 0, and the control manager received 1,000e18.

Sources#

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 58610-h-02-validatormanager-missing-fund-withdrawal-from-validator_exp (evm-hack-registry mirror).
AuditVault finding: 58610-h-02-validatormanager-missing-fund-withdrawal-from-validator.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync