# Unfinalized config read as set

Consumers trusting config, dict, or listing before a finalize step writes or validates required keys

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-03-24. Updated 2026-10-25._

## How it works
A consumer reads a config, dictionary, or listing and assumes it is complete and validated. But the finalize step that would write required keys, squash prior entries, or lock values has not run yet. The reader therefore trusts attacker-influenced or unconstrained state. The broken assumption is "finalized means set"; in reality the object is still mutable or partially unconstrained.

## Where it shows up
- A dictionary is reassigned (`dict_new`, `default_dict_new`, reset) on one branch while another branch calls `finalize` [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md).
- Payout or settlement code reads denom from mutable state [E3](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-07.md).
- A setter's guard checks only time or liveness, not whether obligations are settled [E3](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-07.md).
- Early-return branches that skip the finalize path taken by the main branch [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md).
- In zkVM AIRs, bus-relevant columns (timestamp, address, value) left free on dummy rows because the gating flag is only constrained through a bridge that is disabled when `is_valid=0` [E1](https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.3.md).

## How to review
For every read of config/dictionary/listing, find the write that finalizes it and prove the read cannot happen before that write. The invariant: a consumer of a finalized object must be reachable only after finalize, and every branch that reassigns or mutates must finalize or lock first. Check each `dict_new`/reset for a matching `finalize` [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md). Check each setter guard for unsettled obligations, not just time [E3](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-07.md). In AIRs, confirm bus-relevant columns are constrained independently of `is_valid` [E1](https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.3.md).

## Variants seen
- Cairo dictionary reassigned without `default_dict_finalize`, leaving prior reads unvalidated [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md).
- CosmWasm listing editable before finalization, so payout uses a swapped denom [E3](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-07.md).
- zkVM dummy ALU rows with unconstrained timestamp/address/value chained with timestamp overflow [E1](https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.3.md).

## Impact and severity
Forged hash outputs [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md), theft of pooled deposits [E3](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-07.md), and arbitrary register-read insertion in a zkVM when chained with timestamp overflow [E1](https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.3.md). High severity: the flaw defeats the soundness or solvency guarantee of the whole component, and worsens when the unfinalized object feeds a payout or proof directly.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.3.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-07.md