# Marking a backup makes recovery impossible (recover list never queried)

Swafe's recover_backups returns the backups vector instead of the recover queue, so marked backups vanish and guardian share uploads fail, permanently blocking secret recovery.

- Payout: Contest reward
- Severity: medium
- Program: Swafe
- Credited: gwumex
- Disclosed: 2026-05-04
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-11-swafe#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Rust smart contract account state / reconstruction upload-share endpoint
**Root cause:** AccountStateV0::recover_backups iterates self.backups instead of the recover queue, so backups moved by mark_recovery are no longer visible to recover_id lookups.
**Steps:**
1. Create a backup via the account contract so it lands in self.backups.
2. Call AccountSecrets::mark_recovery, moving the backup from backups into the recover queue (`lib/src/account/v0.rs#L516-L523`).
3. Call `account.recover_id`, which iterates `AccountState::recover_backups` (`lib/src/account/v0.rs#L236-L247`) returning `self.backups`.
4. Observe the marked backup is absent; POST guardian shares to `/reconstruction/upload-share` and get 'Backup not found' (`contracts/src/http/endpoints/reconstruction/upload_share.rs#L48-L50`).
**How found:** Code reading of the recovery flow: traced mark_recovery moving entries out of backups, then noticed recover_backups still returns self.backups, breaking the recover_id lookup used by upload-share.
**Insight:** When a state machine moves items between collections, audit every accessor that reads the source collection—stale getters silently break downstream lookups like share uploads.