Submitted by maxzuvex, also found by 0xAlix2 and TheSchnilch
https://github.com/code-423n4/2025-04-cabal/blob/5b5f92ab4f95e5f9f405bbfa252860472d164705/sources/cabal_token.move#L219-L227
An attacker holding Cabal LSTs (like sxINIT) can monitor the mempool for the managers voting_reward::snapshot() transaction. By submitting his own cabal::initiate_unstake transaction to execute in the same block (H) as the managers snapshot, the attacker can use two flaws:
Attacker Exploit:
Impact:
