# Circuit Breaker Authorization Issue

Cosmos SDK circuit breaker reset lacked per-message permission check, letting SOME_MSGs users re-enable any tripped message.

- Payout: hidden
- Severity: medium
- Program: Cosmos
- Found by: strikeout
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2120609
- Library page: https://bugbountylibrary.com/r/h1%3A2120609
- Tags: area:web3 domain:web3 impact:integrity kind:bounty platform:hackerone sev:medium tech:go technique:source-review vuln:access-control vuln:auth-bypass

**Target:** x/circuit keeper MsgServer ResetCircuitBreaker
**Root cause:** ResetCircuitBreaker's SOME_MSGs branch omits the per-message permission loop that TripCircuitBreaker performs, so any SOME_MSGs holder can reset any message.
**Steps:**
1. Use Cosmos SDK v0.50.0-rc.0
2. Replace x/circuit/keeper/msg_server_test.go with provided PoC test
3. Run `go test -mod=readonly -run TestResetCircuitBreakerMaxPOC -v`
4. Observe user with only `url` permission successfully resets `url_bad` breaker
**How found:** Compared trip vs reset code paths in msg_server.go; noticed the permission loop present in TripCircuitBreaker was missing in ResetCircuitBreaker.
**Exploitation:** A user granted SOME_MSGs permission for one message calls ResetCircuitBreaker on an unrelated tripped message, re-enabling it after an admin disabled it.
**Escalation:** Re-enabling a tripped vulnerable module (e.g. banking) lets attackers resume exploiting it, potentially draining funds.
**Insight:** When a module has parallel privileged operations (trip/reset, enable/disable), diff their authorization branches—missing loops in one path are a common access-control gap.