# The reveal process could brick if randProvider stops working

If randProvider stops responding after requestRandomSeed sets waitingForSeed, revealGobblers and upgradeRandProvider both revert, permanently bricking reveals and goo emission.

- Payout: Contest reward
- Severity: medium
- Program: Art Gobblers
- Credited: zzykxx
- Disclosed: 2022-12-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-artgobblers-findings/issues/153
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-artgobblers%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** ArtGobblers.sol randomness reveal state machine
**Root cause:** requestRandomSeed sets waitingForSeed=true; only randProvider's acceptRandomSeed can clear it, but revealGobblers and upgradeRandProvider both revert while waitingForSeed is true, so a dead provider locks the state permanently.
**Steps:**
1. Mint a gobbler and call `gobblers.requestRandomSeed()` to set `waitingForSeed=true`.
2. Assume randProvider never calls `callBackWithRandomness`/`acceptRandomSeed`.
3. Call `gobblers.revealGobblers(1)` -> reverts with `SeedPending`.
4. Deploy new ChainlinkV1RandProvider and call `gobblers.upgradeRandProvider(newRandProvider)` -> reverts with `SeedPending`.
5. State is unrecoverable; new gobblers keep emissionMultiple 0 and mint no goo.
**How found:** Code-reading of the reveal state machine: noticed waitingForSeed is only cleared by the provider itself while both recovery paths (reveal and upgrade) guard on it, creating a deadlock on provider failure.
**Insight:** When a state flag gates both the normal path and the admin recovery path, and only an external party can clear it, the contract deadlocks if that party fails; check every 'waiting' flag for an owner-accessible escape hatch.