Attacker can make his stake immune to verifyOvercommittedStake.

Lines of code Vulnerability details Impact verifyOvercommittedStake for an EigenPod will be DOSed, and Attacker's shares will never be reduced even when his stake on BeaconChain gets slashed, and someone attempts to record the overcommitment. Proof of Concept Here is the...

Slot and block number proofs not required for verification of withdrawal (multiple withdrawals possible)

Lines of code Vulnerability details Impact Since this is a vulnerability which involves multiple in-scope contracts and leads to more than one impact, let's start with a bug desciption from bottom to top. Library Merkle The methods verifyInclusionSha256proof, root, leaf, index and...

The length of proofs.slotProof is not checked in the verifyWithdrawalProofs function, allowing a malicious EigenPod Owner to be issued only shares via StrategyManager and withdraw all their money

Lines of code Vulnerability details Impact Below is a portion of the verifyAndProcessWithdrawal function. // Verifying the withdrawal as well as the slot BeaconChainProofs.verifyWithdrawalProofsbeaconStateRoot, withdrawalProofs, withdrawalFields; // Verifying the validator fields, specifically th...

verifyWithdrawalCredentialsAndBalance does not verify that oracleBlockNumber is the latest block number.

Lines of code Vulnerability details Impact After participating in Ethereum Staking, you may receive shares based on your balance when it was 32 ETH, even though you may have suffered a certain level of slashing at 32 ETH. Until some conscientious watcher proves the slashing in the Consensus Layer...