# An attacker can manipulate each pod and gain an advantage over the remainder Operators

HolographOperator reuses one random number for pod and operator selection, letting an attacker join/leave pods to bias job selection odds in their favor.

- Payout: Contest reward
- Severity: high
- Program: Holograph
- Credited: eighty
- Disclosed: 2022-12-15
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-10-holograph-findings/issues/168
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-holograph%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** HolographOperator.sol crossChainMessage operator/pod selection
**Root cause:** The same random value is used both to pick the pod (random % totalPods) and the operator within it (random % podLength), creating a biased distribution; combined with free join/leave and swap-on-pop mechanics, an attacker can shape pod composition to skew selection odds.
**Steps:**
1. Read crossChainMessage L499-L511: random generated once, pod = random % totalPods, operator = random % podOperatorsLength.
2. Monitor getTotalPods and getPodOperatorsLength to learn current pod sizes and operator counts.
3. Choose a target pod and deploy bots to fill specific indexes, exploiting the modulo bias and the pop-swap (last index moved to chosen operator's slot).
4. Iterate: when not selected, assume the popped operator's position and deploy another bot to maintain/raise odds; when selected, optionally wait to return to pod.
5. Repeat to accumulate a disproportionate share of job selections and rewards.
**How found:** Code reading of the selection logic revealed the same random value feeds both modulo operations; combined with documented join/leave and pop-swap behavior, the auditor reasoned an attacker could deterministically shape pod composition to bias outcomes.
**Exploitation:** Attacker controls multiple operators, joins/leaves a chosen pod to manipulate its length and index layout, and times bot deployments around job selection and pop-swap events to repeatedly land in favorable modulo positions, capturing a larger share of operator job rewards than honest operators.
**Escalation:** Iterating deployments and re-joining after each selection lets the attacker progressively control a majority of pod indexes, potentially starving honest operators of incentives.
**Insight:** When a single random value is reduced modulo two different lengths, the joint distribution is skewed; check whether users can cheaply alter either modulus (pod membership) or the index layout (swap-on-remove) to convert statistical bias into a controllable advantage.