# Permissionless registration squats shared slot

User-writable mappings or slots that privileged setup later reads and reverts on, or unvalidated IDs filling capped slots

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-11-20. Updated 2026-10-25._

## How it works
A shared storage slot or capped resource is written by a permissionless action and later read by a privileged or global operation that assumes it only contains trusted entries. An attacker pre-populates the slot with a value that is valid enough to be stored but invalid for the privileged path, so the privileged call reverts or the shared resource is exhausted. The broken assumption is that "only legitimate actors write this key" or "any stored value is usable."

## Where it shows up
- A mapping written in a user-callable registration/setup function and also read by an admin function that reverts on non-zero.
- Deposit or fund functions that decode a user-supplied index/ID and store it without bounds-checking against the array it will later match.
- Capped slots (NFT counts, tier lists) filled by arbitrary caller-supplied IDs.
- Validation commented out or skipped "for code size," letting untrusted addresses into a trusted set.
- Gauge/pool/pair registration that sets a trusted flag without provenance checks.

## How to review
For every slot written by an unprivileged caller, find every privileged or global reader and ask whether a hostile value can make it revert or misbehave. The invariant: a privileged operation must not depend on state that an unprivileged caller can set to a value the operation rejects. Check that user-supplied indices are validated against the target array length before storage, and that any address later called in a loop was verified against a trusted factory/registry. Trace downstream calls into any address accepted without provenance.

## Variants seen
- User-created hToken populates a mapping key shared with ecosystem-token registration, making addEcosystemToken() revert [E1](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-01.md).
- Arbitrary tier IDs fill all NFT slots with unclaimable tiers, disabling prizes [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AM-3.md).
- Unverified CL pool accepted as a pair; reverting updateRewardsGrowthGlobal bricks distributeAll() [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-09.md).

## Why fixes fail
E3 shows a check removed "due to code size," leaving the trusted-flag shortcut in place; the missing provenance check turns into global liveness failure once the fake pool is voted in.

## Impact and severity
Governance setup blocked [E1](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-01.md), prize distribution disabled [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AM-3.md), and global reward distribution bricked [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-09.md). Severity rises when the squatted slot feeds a loop or global call, converting a local write into protocol-wide denial of service.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-01.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AM-3.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-09.md