# Missing cooldown or cap grants instant power

Repeatable or atomic actions that grant voting power, extend terms, or block parameter changes without cooldown or cap

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2024-04-05. Updated 2026-10-25._

## How it works
An action that grants power (voting weight, a longer term, a registration) is gated only by a boolean, an expiry, or a current-state check, with no counter, rate limit, or cooldown. The assumption that "the gate limits this" breaks because the gate can be re-satisfied or the state inflated before anyone reacts. Power is acquired instantly and atomically, so governance or the counterparty never gets a window to respond.

## Where it shows up
- State-changing functions gated only by a boolean flag (e.g. `rollable`) or an expiry timestamp, with no per-action counter or time window [E1](https://bugbountylibrary.com/r/sherlock%3A2023-01-cooler%3AH-2.md)
- Flags initialized true by default, so the gate is open from creation [E1](https://bugbountylibrary.com/r/sherlock%3A2023-01-cooler%3AH-2.md)
- Setters that revert when a new parameter is below current user-inflatable state (e.g. cap vs. pool total + pending deposits) [E2](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-03.md)
- Deposit and registration paths with no cooldown or rate limit, callable in the same block [E3](https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2024%3A3.2.1.md)
- Confirmation windows measured in a couple of blocks, too short for governance to pause [E3](https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2024%3A3.2.1.md)

## How to review
For each power-granting action, ask: can it be repeated, or completed atomically, before any counter-party or governance can react? The invariant: acquiring power must be bounded by a cap, a cooldown, or a time window that outlasts the reaction time of the party it affects. Check that setters validate against state users cannot permissionlessly inflate, and that registration plus stake acquisition cannot complete within the confirmation window.

## Variants seen
- Unlimited repetition of a term-extending action via a boolean gate [E1](https://bugbountylibrary.com/r/sherlock%3A2023-01-cooler%3AH-2.md)
- Front-running a governance setter with a deposit to make it revert [E2](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-03.md)
- Atomic mint, deposit, and operator registration within a two-block window [E3](https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2024%3A3.2.1.md)

## Impact and severity
Led to indefinite loan extension against the lender's will [E1](https://bugbountylibrary.com/r/sherlock%3A2023-01-cooler%3AH-2.md), blocked or delayed governance parameter updates [E2](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-03.md), and hijacked AVS quorums from a compromised external token [E3](https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2024%3A3.2.1.md). Severity rises when the action is atomic and the reaction window is short, and when the affected party has no veto.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-01-cooler%3AH-2.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-03.md
- E3: https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2024%3A3.2.1.md