# The lock_pool operation can be DoS

Meteora lock_escrow PDA is derived from pool and owner without owner signature, so an attacker pre-creates it to block Pump Science's lock_pool migration.

- Payout: Contest reward
- Severity: high
- Program: Pump Science
- Credited: shaflow2
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-01-pump-science#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-pump-science%3AH-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solana technique:source-review vuln:access-control vuln:dos

**Target:** Solana migration instruction lock_pool / Meteora create_lock_escrow CPI
**Root cause:** lock_escrow is a PDA seeded by pool and owner but create_lock_escrow requires no owner signature, so anyone can initialize it first; lock_pool then unconditionally CPIs create_lock_escrow which fails on an existing account.
**Steps:**
1. Identify target pool and its owner pubkey from on-chain state.
2. Derive PDA: `find_program_address(["lock_escrow", pool.key, owner.key], meteora_program_id)`.
3. Call Meteora `create_lock_escrow` with that PDA, pool, owner, lp_mint, paying own account as payer/signer.
4. Later, Pump Science's lock_pool invokes create_lock_escrow via invoke_signed; the `init` constraint fails because the account already exists, reverting the migration.
**How found:** Code review of lock_pool's CPI into Meteora create_lock_escrow; noticed the lock_escrow PDA seeds (pool, owner) and that owner is an UncheckedAccount with no signer requirement, making the init front-runnable.
**Exploitation:** Attacker front-runs the migration by initializing the deterministic lock_escrow PDA for the victim pool/owner at negligible cost, permanently blocking lock_pool until the program handles pre-existing escrows.
**Insight:** When a program CPIs into a third-party `init` for a PDA whose seeds include an unsigned account, the PDA is attacker-initializable; check every CPI target's signer requirements against the seeds you rely on.