# Front-run of privileged state transitions

Privileged or one-shot transitions whose preconditions read state an unprivileged caller can cheaply move first

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-01-05. Updated 2026-10-25._

## How it works
A privileged or one-shot transition validates against live state, then acts. If an unprivileged caller can cheaply move that state first, the precondition fails and the transition reverts. The broken assumption: "only the admin (or the intended actor) can change the inputs to this check." When the check reads user-influenced state, anyone can push it out of bounds before the legitimate call lands.

## Where to review
- Setters or governance functions that revert when a new value is below current totals, balances, or pending amounts.
- Per-recipient caps or quotas enforced on the recipient's balance during transfer/supply.
- One-shot migration/bridge functions whose amount comes from a call that zeroes after first use.
- Caller-supplied message/ticket parameters (gas, deposit) on cross-chain retryable tickets.

## How to review
For each privileged transition, list every state value its precondition reads. Ask: can an unprivileged caller change that value, at low cost, before the transition runs? The invariant: a privileged transition must either (a) validate against state users cannot inflate, (b) tolerate the current value (clamp, not revert), or (c) be atomic with the state change it depends on. For caps, check enforcement is on the sender/actor, not the recipient. For one-shot functions, check the single attempt cannot be consumed with attacker-chosen parameters.

## Variants seen
- Recipient-side balance cap filled with near-worthless assets, blocking victim deposits before liquidation [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-10.md).
- LP deposit inflates pool total so a cap-reduction setter reverts, delaying governance [E2](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-03.md).
- Permissionless one-shot migration with attacker-controlled ticket params strands escrowed funds and DoSs migration [E3](https://bugbountylibrary.com/r/c4%3A2022-01-livepeer%3AM-01.md).

## Impact and severity
Locked collateral and blocked liquidation [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-10.md); delayed governance parameter changes [E2](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-03.md); stranded bridge funds and DoS of migration [E3](https://bugbountylibrary.com/r/c4%3A2022-01-livepeer%3AM-01.md). Severity rises when the blocked transition is time-sensitive (liquidation, migration) or when attack cost is near zero (zero-liquidity NFTs, small deposits).

Note: a related but distinct shape is a mutation path that simply lacks a bound the sibling path enforces (absent validation, not state inflation); review it separately.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-10.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-01-livepeer%3AM-01.md