# Broken Lineage Check Lets Anyone Create Approved Announcers

Anyone could exit a non-approved atom announcer layer as a keeper, minting a coin that passes lineage checks as governance-approved, enabling control of the XCH/USD price feed.

- Payout: Contest reward
- Severity: critical
- Program: Circuit Puzzles
- Credited: yakuhito
- Disclosed: 2025-08-21
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_circuit_puzzles.pdf#3.1.5
- Library page: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.5
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:critical tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:oracle-manipulation

**Target:** Chialisp atom announcer configure puzzle (announcer_configure.clsp)
**Root cause:** The 'exit layer' path of the atom announcer configure puzzle is triggerable by anyone (owner or keepers) and creates a coin with INNER_PUZZLE_HASH without asserting the inner puzzle hash, so a non-approved layer can be exited with an APPROVED=1 inner puzzle hash.
**Steps:**
1. Create a non-approved atom announcer coin.
2. Set the inner puzzle hash to that of an atom announcer layer with APPROVED=1.
3. Trigger the 'exit announcer layer' path as a keeper without executing the inner puzzle.
4. Resulting coin's parent top puzzle is a non-approved atom announcer, so lineage checks treat it as governance-approved.
5. Repeat to register arbitrarily many approved announcers.
**How found:** Code review of announcer_configure.clsp exit-layer path; noted the exit path is callable by keepers and creates a coin with INNER_PUZZLE_HASH without asserting it, then reasoned that a non-approved layer could exit into an APPROVED=1 inner puzzle hash and still pass lineage checks because the parent top puzzle is non-approved. Related to prior Zellic governance-coin unwrap finding.
**Exploitation:** Attacker mints unlimited fake-approved atom announcers, capturing most announcer registry rewards and gaining full control of the XCH/USD price feed; setting XCH to 0.1 USD could force most vaults with active principal into liquidation, with little or no price-update delay since the large change bypasses oracle timestamp checks.
**Escalation:** From reward theft to oracle price manipulation, forcing vault liquidations protocol-wide.
**Insight:** When a puzzle has an 'exit layer' path callable by non-owners, check whether the inner puzzle hash is asserted; if not, an attacker can substitute an approved inner puzzle hash and the resulting coin's lineage still points at the unapproved parent, bypassing governance approval.