Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Kinetiq — Some stakers may fail to withdraw staking HYPE

1. Stake path fills hypeBuffer up to targetBuffer before delegating. 2. queueWithdrawal never spends the buffer; it always undelegates from currentDelegation. 3. After a delegation switch to a validator with 0 stake, even a buffer-covered withdrawal reverts. 4. Control path that drains buffer first…

Feb 2025•Other•untagged•3 min read

Chain

Other

Category

untagged

Date

Feb 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 58614-h-06-some-stakers-may-fail-to-withdraw-staking-hype-pashov-a. Standalone Foundry PoC and full write-up: 58614-h-06-some-stakers-may-fail-to-withdraw-staking-hype-pashov-a_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/reward-accounting · dos/lockup · loss-of-funds/locked-funds

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC, no anvil_state. Full trace: output.txt. PoC: test/58614-h-06-some-stakers-may-fail-to-withdraw-staking-hype-pashov-a_exp.sol.

AuditVault taxonomy: severity/high · sector/staking · sector/liquid-staking · reward-accounting · dos-resistance · dos/lockup · loss-of-funds/locked-funds · known-pattern

Key info#

ImpactHIGH — withdrawals ignore hypeBuffer and force validator undelegation; can revert when current validator has insufficient stake
ProtocolKinetiq — StakingManager buffer
Vulnerable codequeueWithdrawal → always _withdrawFromValidator
Bug classBuffer not used on exit (Lido-style buffer inverted)
FindingPashov Audit Group · Kinetiq 2025-02-26 · #58614 · H-06
ReportKinetiq-security-review_2025-02-26
SourceAuditVault
StatusAudit finding. Reproduced as a standalone local PoC.
Compiler^0.8.24 (PoC)

TL;DR#

  1. Stake path fills hypeBuffer up to targetBuffer before delegating.
  2. queueWithdrawal never spends the buffer; it always undelegates from currentDelegation.
  3. After a delegation switch to a validator with 0 stake, even a buffer-covered withdrawal reverts.
  4. Control path that drains buffer first succeeds for the same request.
  5. Fix: service from buffer first; only undelegate the shortfall.

The vulnerable code#

SOLIDITY
_withdrawFromValidator(currentDelegation, amount); // @> VULN
// FIX: use hypeBuffer first, then undelegate remainder

Root cause#

The buffer exists only on the deposit path. Exit logic treats every withdrawal as a validator exit, defeating the reserve and coupling user exits to the current validator's L1 balance (which may be empty after rebalance).

Preconditions#

  • Non-zero targetBuffer with buffer actually filled.
  • currentDelegation has less stake than the withdrawal (e.g. after setDelegation to a fresh validator).

Attack walkthrough#

  1. Stake 100 HYPE with targetBuffer = 50 → 50 buffer, 50 on VAL_A.
  2. Operator sets current delegation to VAL_B (0 stake).
  3. User queues 40 HYPE — buffer has 50, but code undelegates 40 from VAL_B → revert.
  4. Fixed path consumes 40 from buffer and succeeds.

Diagrams#

sequenceDiagram participant User participant SM as StakingManager participant Buf as hypeBuffer participant ValB as VAL_B User->>SM: stake 100 HYPE SM->>Buf: fill 50 Note over SM: switch delegation to VAL_B User->>SM: queueWithdrawal 40 SM->>ValB: undelegate 40 ValB-->>SM: revert insufficient stake Note over Buf: 50 unused

Impact#

Stakers can be unable to queue withdrawals despite idle buffer liquidity. Combined with rebalancing (L-08-adjacent), this becomes a selective / systemic exit DoS and forces unnecessary validator exits when the buffer could have paid.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.