# LlamaPolicy could be DOS by creating large amount of actions

ActionCreator can spam createAction every block, making _assertNoActionCreationsAtCurrentTimestamp always revert and blocking all role/policy changes.

- Payout: Contest reward
- Severity: medium
- Program: Llama
- Credited: ktg
- Disclosed: 2023-07-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-llama-findings/issues/64
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-llama%3AM-03
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:dos

**Target:** LlamaPolicy / LlamaCore governance contracts
**Root cause:** _setRoleHolder calls _assertNoActionCreationsAtCurrentTimestamp which reverts if any action was created in the current block; createAction is unthrottled, so an ActionCreator can keep the check tripping indefinitely.
**Steps:**
1. Grant ActionCreator role permission for a target selector via `mpPolicy.setRolePermission`.
2. Call `mpCore.createAction(...)` as actionCreatorAaron.
3. Attempt `mpPolicy.setRoleHolder(...)` in same block -> reverts `ActionCreationAtSameTimestamp`.
4. `vm.warp(block.timestamp + 1)` and create another action; setRoleHolder reverts again.
5. Repeat each block (~2.5M actions/month) to permanently block role changes.
**How found:** Code reading of _setRoleHolder's _assertNoActionCreationsAtCurrentTimestamp guard, noticing createAction has no rate limit, so the guard can be kept tripped continuously.
**Exploitation:** A holder of the ActionCreator role submits at least one action per block; since role supply is not checkpointed, the policy forbids role mutations in any block containing an action, so revoking expired roles, revoking policy, and other _setRoleHolder operations are permanently blocked.
**Insight:** When a contract uses a same-block guard to preserve accounting invariants, check whether the guarded condition can be re-triggered cheaply each block by an unprivileged actor; a per-block revert becomes a permanent DoS if the trigger is unthrottled.