# Announcers can avoid being penalized

Announcer penalty puzzle unconditionally asserts price expiry time, so undercollateralized or over-delayed announcers escape penalties until their price TTL lapses.

- Payout: Contest reward
- Severity: medium
- Program: Circuit Puzzles
- Credited: 0xDggin
- Disclosed: 2025-08-21
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_circuit_puzzles.pdf#3.3.5
- Library page: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.5
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Chialisp announcer_penalize.clsp penalty puzzle
**Root cause:** The penalty branch asserts ASSERT_SECONDS_ABSOLUTE TIMESTAMP_EXPIRES unconditionally, so even when a deposit/delay violation is detected, the transaction fails unless the price has already expired.
**Steps:**
1. Announcer registers with DEPOSIT below min_deposit (e.g. 5 XCH vs 10 XCH required).
2. Keeper submits penalty tx; the `any` clause returns TRUE on `(> MIN_DEPOSIT DEPOSIT)`.
3. Tx then hits `(list ASSERT_SECONDS_ABSOLUTE TIMESTAMP_EXPIRES)` requiring current_timestamp >= TIMESTAMP_EXPIRES.
4. Since TIMESTAMP_EXPIRES = current_timestamp + DELAY from last mutate, assertion fails and penalty reverts.
5. Announcer keeps updating price via announcer_mutate.clsp, refreshing TIMESTAMP_EXPIRES and never getting penalized.
**How found:** Code review of announcer_penalize.clsp: noticed the `any` clause permits three violation types but the trailing ASSERT_SECONDS_ABSOLUTE TIMESTAMP_EXPIRES gates all of them on price expiry, contradicting the intended penalty logic.
**Exploitation:** A malicious or negligent announcer maintains periodic price updates so TIMESTAMP_EXPIRES stays in the future, permanently dodging penalties for insufficient collateral or excessive delay while retaining oracle rewards and governance weight.
**Escalation:** Persistent undercollateralization plus governance voting weight (proposals, veto, surplus/recharge auctions) lets announcers damage protocol economics and governance.
**Insight:** When a puzzle's `any` clause enumerates multiple violation conditions, verify each downstream assertion is compatible with every branch — a single unconditional time/state assertion can silently gate the whole disjunction.