# In case of exectransaction() reentrancy all owners will be marked as live

LivenessGuard's ownersBefore map is overwritten during Safe transaction reentrancy, causing checkAfterExecution to mark all owners as live.

- Payout: Contest reward
- Severity: medium
- Program: Optimism
- Credited: 0xA5DF
- Disclosed: 2024-06-06
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_optimism_may2024.pdf#3.1.4
- Library page: https://bugbountylibrary.com/r/cantina%3Aoptimism_may2024%3A3.1.4
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity vuln:business-logic vuln:reentrancy

**Target:** LivenessGuard.sol Safe guard (checkTransaction/checkAfterExecution)
**Root cause:** checkTransaction stores current owners in a single ownersBefore map; a reentrant transaction B overwrites it, so when transaction A's checkAfterExecution runs, ownersBefore is empty and every owner appears new and is marked alive.
**Steps:**
1. Owners sign tx A (send NFT to Alice's contract) and tx B (send 5K USDC to Bob).
2. Alice modifies her contract so onERC721Received() executes tx B.
3. Alice triggers tx A; during execution the contract reenters and executes tx B.
4. checkTransaction for B overwrites ownersBefore; checkAfterExecution for A sees empty ownersBefore and marks all owners alive.
**How found:** Code reading of LivenessGuard: noticed ownersBefore is a single shared map written in checkTransaction and read in checkAfterExecution, and reasoned that nested/reentrant executions would clobber it.
**Exploitation:** Attacker (a recipient contract) reenters the Safe during a callback to execute a second pre-signed transaction, resetting ownersBefore so the guard marks every owner as live, defeating the liveness/dead-man-switch accounting.
**Insight:** When auditing Safe guards, check whether per-transaction state is stored in a single slot rather than keyed per execution; any callback into the Safe (ERC721/ERC1155 receive, ETH receive) can reenter and corrupt that state.