# An arbitrary block winner can open another provider's commitment and get rewarded, without even needing to stake

openCommitment derives committer address from a user-supplied signature, letting any L1 block winner open another provider's commitment and collect rewards without staking.

- Payout: Contest reward
- Severity: medium
- Program: Primev
- Credited: sammy
- Disclosed: 2025-08-27
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.2.11
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.11
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:reward-distribution vuln:signature-replay

**Target:** preconfManager openCommitment / commitment registry
**Root cause:** openCommitment() recovers committerAddress from a caller-supplied commitmentSignature rather than binding the committer into the commitmentDigest, so any signer can impersonate the committer.
**Steps:**
1. Provider calls storeUnopenedCommitment() with bid params; only the hash is stored on-chain.
2. L1 block is posted; block winner obtains commitment params off-chain (or is the provider).
3. Block winner signs commitmentDigest with their own key: `vm.sign(blockWinnerPk, commitmentDigest)` producing fakeCommitmentSignature.
4. Block winner calls `openCommitment(blockWinner, unopenedIndex, ...bid params..., fakeCommitmentSignature, sharedSecretKey)`.
5. Contract recovers blockWinner as committer, opens commitment, rewards block winner without any stake.
**How found:** Code reading of openCommitment: noticed committerAddress is derived from user-supplied commitmentSignature instead of being part of the signed digest; observed storeUnopenedCommitment only stores the hash, so params must come off-chain.
**Exploitation:** Block winner (or provider using a second address) signs the commitment digest with their own key and calls openCommitment with the victim's stored commitment params; the recovered committerAddress matches the caller, so the commitment opens and the caller is rewarded while never having staked or being slashable.
**Escalation:** Provider can run two addresses: one storing commitments, another winning blocks and opening them, guaranteeing rewards and avoiding slashing.
**Insight:** When a contract recovers an identity from a signature, check whether that identity is bound into the signed digest; if not, any signer can impersonate the claimed role. Also check whether hash-only storage forces off-chain param leakage that enables the impersonation.