# Guardian share replay overwrite causes persistent recovery DoS (missing session binding)

Guardian share upload endpoint lacks recovery-session binding, letting anyone replay stale shares to overwrite fresh ones and permanently block social recovery.

- Payout: Contest reward
- Severity: medium
- Program: Swafe
- Credited: czarcas7ic
- Disclosed: 2026-05-04
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-11-swafe#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:rest technique:chained technique:source-review vuln:dos vuln:signature-replay

**Target:** HTTP recovery endpoint /reconstruction/upload-share and guardian share storage
**Root cause:** Shares are encrypted to a per-session recovery_pke but stored keyed only by (account_id, backup_id, share_id) with blind overwrite, so stale shares from prior sessions still pass verify but fail decryption in the current session.
**Steps:**
1. Initiate recovery session 1; guardians upload shares encrypted under recovery_pke1.
2. Attacker fetches encoded GuardianShares via /reconstruction/get-shares (or recorded traffic).
3. Session 1 fails; user initiates session 2 with fresh recovery_pke2; guardians upload new shares.
4. Attacker replays session-1 shares to /reconstruction/upload-share; backup.verify passes and overwrites fresh shares.
5. RecoverySecrets::complete decrypts with dkey2; stale shares fail and are filtered, dropping below threshold -> InsufficientShares.
6. Repeat each new session to persistently deny recovery.
**How found:** Code reading noted the in-code comment claiming multiple share versions are equivalent, then observed that per-session recovery_pke encryption breaks that assumption while storage remains session-agnostic.
**Exploitation:** Unauthenticated attacker obtains old guardian ciphertexts from the public get-shares endpoint, waits for a new recovery session, then replays stale shares to overwrite fresh ones, causing decryption failure and threshold shortfall at completion.
**Escalation:** Replay repeated across every subsequent recovery attempt to make the DoS persistent.
**Insight:** When ciphertexts are bound to an ephemeral per-session key, any storage keyed only by logical identity (backup+index) with blind overwrite becomes replayable; check whether verify() validates session binding, not just share validity.