# Caller-supplied type or identity trusted

Functions that read type, identity, or vendor fields from caller input instead of the canonical stored value

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-09-26. Updated 2026-10-24._

## How it works
A function needs to know something about an asset or peer: its type, its identity, its capabilities. Instead of reading that from the canonical on-chain record or the authenticated session state, it takes it as a parameter or from a caller-supplied payload. The caller then chooses which limits, config, or verification path apply to them. The broken assumption is that the caller will honestly describe itself; nothing enforces that the supplied value matches the stored one.

## Where it shows up
- A function parameter (e.g. `fighterType`) that also indexes per-type limits, generation, or config arrays, while the real type lives in storage [E3](https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-04.md)
- Registration or factory functions that call getters on a caller-supplied contract (avatar, token) without checking that contract is the canonical one [E2](https://bugbountylibrary.com/r/dhl%3A20260926-daostack.md)
- Protocol payload fields (vendor IDs, feature bitmasks, capability flags) written into auth state and later gating a verification check [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751.md)
- Validation functions whose signature changed to drop a parameter, with callers still trusting a state field the client can write [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751.md)

## How to review
For every function that accepts a type, identity, or capability value, find where that value is used and ask whether it should instead come from storage or authenticated state. The invariant: any value that selects a limit, config, or verification branch must equal the canonical stored value for the referenced asset, or be derived from authenticated session state, never from caller input. Check that registration functions verify the supplied contract's tokens are not already governed elsewhere [E2](https://bugbountylibrary.com/r/dhl%3A20260926-daostack.md). When a patch removes a parameter from a validation function, trace every caller and every writer of the state field that gates the check [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751.md).

## Variants seen
- Per-type limit bypass: caller-chosen type indexes `maxRerollsAllowed` and `generation`, borrowing another category's limits [E3](https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-04.md)
- Fake asset getters: permissionless registration trusts a caller-supplied avatar's getters, letting an attacker claim a victim's reputation [E2](https://bugbountylibrary.com/r/dhl%3A20260926-daostack.md)
- Auth-flag injection: client-supplied vendor bitmask sets a state flag that short-circuits signature verification [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751.md)

## Impact and severity
High to critical. Outcomes ranged from bypassing per-asset limits [E3](https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-04.md) to full authentication bypass as any provisioned user [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751.md) and draining a governance avatar's funds (4.025 ETH) [E2](https://bugbountylibrary.com/r/dhl%3A20260926-daostack.md). Severity rises when the trusted value gates a security check rather than a business limit, and when the function is permissionless.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260926-daostack.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-04.md