# Shared secret can be altered to farm a bid multiple times

Provider alters unsigned sharedSecretKey to mint many distinct commitmentIndexes for one bid, draining a bidder's deposit across repeated settlements.

- Payout: Contest reward
- Severity: high
- Program: Primev
- Credited: hash
- Disclosed: 2025-08-27
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.1.6
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.6
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:signature-replay

**Target:** PreconfManager.sol openCommitment / initiateReward
**Root cause:** commitmentIndex is keccak(commitmentDigest, commitmentSignature), and commitmentDigest includes sharedSecretKey which is not covered by the bidder's bidSignature, so one bid yields many valid commitment indexes.
**Steps:**
1. Bidder deposits 100 and signs a bid of 10 via verifyBid (bidSignature covers bid, blockNumber, decay times, txnHash, revertingTxHashes).
2. Provider calls `openCommitment(...)` with the same bid but varying `sharedSecretKey` values.
3. Each call produces a different `commitmentDigest` and thus a different `commitmentIndex` from `getOpenedCommitmentIndex`.
4. Provider repeats 10 times to create 10 distinct commitments for the single bid.
5. Each commitment settles via `initiateReward(commitmentIndex, residualBidPercentAfterDecay)`, deducting 10 from the bidder's deposit until the 100 allocation is exhausted.
**How found:** Code reading of commitmentIndex derivation: noticed sharedSecretKey feeds commitmentDigest but is absent from the bidder-signed fields, so it is attacker-controllable per commitment.
**Exploitation:** Malicious provider reuses one signed bid, mutating the unsigned sharedSecretKey to register many commitments, then lets each settle to drain the bidder's per-block deposit.
**Insight:** When an identifier is a hash over signed+unsigned fields, check every field not covered by the signature: any unsigned input becomes a free degree of freedom to mint duplicate identities for the same signed intent.