# Token Change Can Be Frontrun, Blocking Token

JBTokenStore.changeFor lets anyone link a token to their own project before the owner's transfer, then seize token ownership and mint arbitrarily.

- Payout: Contest reward
- Severity: high
- Program: Juicebox
- Credited: philogy
- Disclosed: 2022-10-11
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-07-juicebox-findings/issues/104
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-juicebox%3AH-02
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:race-condition

**Target:** JBTokenStore.changeFor / JBController.changeTokenOf
**Root cause:** changeFor does not verify the caller controls the token being migrated; ownership transfer to the token store is a separate step that can be frontrun.
**Steps:**
1. Owner transfers token ownership to JBTokenStore (or calls changeFor with _newOwner = new store).
2. Attacker frontruns by calling `changeTokenFor` on JBController, invoking `JBTokenStore.changeFor` to link the token to an attacker-controlled project.
3. Attacker calls `changeTokenFor` again with `_newOwner` = attacker address, becoming token owner.
4. Attacker calls owner-restricted `mint` on JBToken-based token to issue arbitrary supply.
**How found:** Code review of changeFor/changeTokenOf flow noticing no check that caller controls the token, combined with the post-mortem's recommendation to transfer ownership to the token store.
**Exploitation:** Attacker observes the pending ownership transfer, frontruns with changeFor to bind the token to their project, then re-invokes changeFor to take ownership and mint unlimited tokens.
**Escalation:** Chains token ownership seizure into arbitrary minting of the migrated token.
**Insight:** When a migration flow separates 'register token' from 'transfer ownership', the registration step is frontrunnable; check whether the contract verifies caller is token.owner() before binding.