# boreWell can be frontrun/DoS-d

Aquifer.boreWell uses a public salt for deterministic Well addresses, letting an attacker frontrun to steal deposits or DoS Well creation.

- Payout: Contest reward
- Severity: medium
- Program: Basin
- Credited: tonisives
- Disclosed: 2023-10-05
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-basin-findings/issues/181
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-basin%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos

**Target:** Aquifer.boreWell Well-creation function (Solidity/EVM)
**Root cause:** Well address is derived from a user-supplied salt alone via cloneDeterministic, so anyone can pre-create a Well at the same deterministic address before the victim's create transaction lands.
**Steps:**
1. Victim broadcasts tx1: boreWell(implementation, salt) and tx2: deposit into resulting Well address.
2. Attacker observes pending txs and frontruns with boreWell(implementation, same salt), occupying the deterministic address.
3. Victim's create tx reverts (address exists), but deposit tx still executes into attacker-owned Well.
4. Attacker, as Well owner, withdraws the deposited funds.
5. For DoS: repeat frontrun with same salt to force victim create txs to revert indefinitely.
**How found:** Code reading of Aquifer.boreWell: noticed the deterministic clone address depends only on a public salt, making it predictable and pre-emptible in the mempool.
**Exploitation:** Attacker watches mempool for boreWell calls, copies the salt, and submits a higher-gas create transaction to claim the deterministic clone address. Victim's deposit then lands in attacker's Well, which attacker drains; alternatively repeated frontruns block Well creation.
**Insight:** When a contract derives a CREATE2/cloneDeterministic address from user-supplied salt without binding msg.sender, the address is predictable and frontrunnable — check any factory that pairs creation with a follow-up deposit or initialization.