# Extending a domain’s expiration even after the grace period impacts domain buyers

Initia name service lets anyone extend a domain's expiration after the grace period, letting the prior owner frontrun and block a new buyer's registration.

- Payout: Contest reward
- Severity: high
- Program: Initia
- Credited: p4y4b13
- Disclosed: 2025-04-10
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-01-initia-move#h-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm technique:source-review vuln:business-logic vuln:race-condition

**Target:** Move name_service module extend_expiration entry function
**Root cause:** extend_expiration() lacks a check that the current timestamp is within expiration_date + grace_period, so expired domains can still be renewed indefinitely.
**Steps:**
1. Alice registers domain `vitalik` for a duration; expiration_date + grace_period elapses.
2. Bob calls `register_domain` to claim the now-available `vitalik`.
3. Alice calls `extend_expiration(account, "vitalik", duration)` with higher gas; her tx executes first.
4. extend_expiration succeeds despite grace period ending, resetting expiration; Bob's register_domain reverts.
**How found:** Code review of name_service.move: noticed extend_expiration had no timestamp bound relative to expiration_date + grace_period, contradicting the registration invariant that expired+grace domains become claimable.
**Exploitation:** Prior domain owner watches for a competing register_domain tx after grace period expiry and frontruns it with extend_expiration paying higher gas, retaining the domain and griefing the buyer.
**Insight:** When a protocol defines a grace period gating when others may claim a resource, check every mutation path (renew/extend/transfer) enforces the same time bound, not just the claim path.