# Adversary can brick AutoRoller by creating another AutoRoller on the same adapter

Adversary creates a second AutoRoller on the same adapter with a maturity matching the first's next roll target, causing sponsorSeries/SpaceFactory to revert and brick rolling.

- Payout: Contest reward
- Severity: high
- Program: Sense
- Credited: 0x52
- Disclosed: 2022-10-31
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-11-sense-judging/issues/20
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-sense%3AH-4
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** AutoRoller / Periphery.sponsorSeries / SpaceFactory.create
**Root cause:** getFutureMaturity truncates to the first of the month, and each adapter allows only one series/pool per maturity; sponsorSeries and SpaceFactory.create revert if the maturity already exists, so a colliding series blocks rolling.
**Steps:**
1. AutoRoller A has duration 3 months, current maturity Dec 1 2022; next roll targets Mar 1 2023 via `getFutureMaturity`.
2. Adversary deploys AutoRoller B on same adapter with duration 4 months and rolls it first, creating series/pool at Mar 1 2023 via `periphery.sponsorSeries(adapter, maturity, true)`.
3. When AutoRoller A rolls, `sponsorSeries` calls `divider.initSeries`/`spaceFactory.create` for Mar 1 2023, which reverts because pool already exists (`POOL_ALREADY_EXISTS`).
4. AutoRoller A is permanently unable to roll.
**How found:** Code reading of onSponsorWindowOpened and getFutureMaturity, noticing maturity is truncated to first-of-month and that SpaceFactory enforces one pool per adapter/maturity, making collisions predictable and exploitable.
**Exploitation:** Attacker sponsors a series at the exact maturity the victim AutoRoller will target next (predictable first-of-month timestamp), occupying the single allowed pool slot for that adapter/maturity and forcing the victim's roll to revert.
**Insight:** When a contract derives a future identifier deterministically (e.g. truncated timestamp) and a downstream registry enforces uniqueness per key, an attacker can pre-register that key to block the victim's state transition; check whether roll/advance logic assumes it can always create the next series.