# Announcer's are unpenalizable at any time by setting a large negative delay during a con- figure

Data providers set a large negative new_delay in announcer_configure, making TIMESTAMP_EXPIRES negative so ASSERT_SECONDS_ABSOLUTE reverts, rendering announcers unpenalizable.

- Payout: Contest reward
- Severity: medium
- Program: Circuit Puzzles
- Credited: alexbabits
- Disclosed: 2025-08-21
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_circuit_puzzles.pdf#3.3.6
- Library page: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.6
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:cantina sev:medium technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** announcer_configure / announcer_penalize Chialisp puzzle
**Root cause:** announcer_configure lacks a positivity/minimum check on new_delay, so TIMESTAMP_EXPIRES can be negative; ASSERT_SECONDS_ABSOLUTE reverts on signed negative integers.
**Steps:**
1. Call `announcer_configure` with `new_delay = -100000000`.
2. TIMESTAMP_EXPIRES becomes `-100000000 + 10000000 = -90000000`.
3. Attempt `announcer_penalize`; the spend hits `ASSERT_SECONDS_ABSOLUTE TIMESTAMP_EXPIRES` at announcer_penalize.clsp#L53 and reverts.
4. Nodes reject the penalization spend from mempool.
**How found:** Code review of announcer_configure found no minimum/negative check on new_delay, then traced TIMESTAMP_EXPIRES arithmetic into ASSERT_SECONDS_ABSOLUTE's signed-integer revert behavior.
**Exploitation:** Provider updates prices while delay is normal, then reconfigures to the negative DoS value to avoid penalties, sleeping indefinitely while still updating prices at will.
**Insight:** When a config value feeds a timestamp/expiry assertion, check whether the assertion opcode reverts on negative signed integers—a negative offset can DoS the enforcement path rather than just mis-set a value.