Skip to content

fix: resolve verifier slashing bypass via exit cooldown - #213

Merged
dDevAhmed merged 4 commits into
DigiNodes:mainfrom
Yasir-TechGuy:fix/verifier-slashing-bypass
May 29, 2026
Merged

fix: resolve verifier slashing bypass via exit cooldown#213
dDevAhmed merged 4 commits into
DigiNodes:mainfrom
Yasir-TechGuy:fix/verifier-slashing-bypass

Conversation

@Yasir-TechGuy

@Yasir-TechGuy Yasir-TechGuy commented May 29, 2026

Copy link
Copy Markdown
Contributor

Closes #181

Overview

This PR resolves issue #181 (VerifierSlashing bypass via exit) by mitigating a critical vulnerability where a malicious verifier could front-run an incoming slash transaction by calling withdrawStake to instantly remove their funds.

🎯 Changes Implemented

  1. Updated Data Structures*: Added an exitTime timestamp field to the VerifierStake struct in TruthBountyWeighted.sol to record when an exit process is initiated.
  2. Enforced Timelock Cooldown: Refactored the withdrawStake function to require a 2-day cooldown period. When first called, it commits an exitTime checkpoint and halts execution. Funds can only be successfully transferred out after the 2-day delay has fully elapsed.
  3. Protected Slashing Mechanism: By delaying token withdrawals, verifier funds are safely locked inside the contract for 2 days, guaranteeing that an admin's slash transaction has ample time to land if a violation occurred.

✅ Verification

  • Solved compilation errors and verified that TruthBountyWeighted.sol builds successfully.
  • Implemented logic in adherence to protocol security invariants to completely eliminate the front-running exit vector.

@dDevAhmed

Copy link
Copy Markdown
Contributor

@Yasir-TechGuy update branch

@dDevAhmed
dDevAhmed merged commit c31b70f into DigiNodes:main May 29, 2026
4 of 8 checks passed
@Yasir-TechGuy

Copy link
Copy Markdown
Contributor Author

nice woking with u

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

VerifierSlashing bypass via exit

2 participants