# Adversary can break deposit queue and cause loss of funds

Malicious receiver reverts ERC1155 safe-mint acceptance check during deposit queue processing, blocking rollover and trapping all prior deposits in a FIFO queue.

- Payout: Contest reward
- Severity: high
- Program: Y2K
- Credited: 0x52
- Disclosed: 2023-03-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-03-Y2K-judging/issues/468
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-Y2K%3AH-5
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Carousel.sol deposit queue / ERC1155 _mintShares
**Root cause:** _mintShares uses OZ ERC1155 _mint which performs _doSafeTransferAcceptanceCheck on the receiver; a receiver contract that always reverts makes the whole queue-processing loop revert.
**Steps:**
1. Attacker deposits into Carousel queue with a receiver contract whose onERC1155Received always reverts
2. Queue processes deposits FIFO; when attacker's entry is reached, _mintShares -> _mint -> acceptance check reverts
3. Entire rollover/queue-processing tx reverts, so no deposits after the attacker can be processed
4. Deposits cannot be canceled, so users queued before/after lose funds
**How found:** Code review of _mintShares noticing it calls OZ ERC1155 _mint, which unlike a plain balance update invokes the receiver acceptance callback; recognized that a reverting receiver in a non-cancelable FIFO queue bricks processing.
**Exploitation:** Attacker queues a minimal deposit from a reverting receiver contract; because queue processing is atomic and FIFO, every subsequent rollover attempt reverts, permanently blocking all queued deposits behind the attacker and locking user funds.
**Insight:** When a protocol mints ERC1155/ERC721 to user-supplied receivers inside a batch/queue loop, the safe-transfer acceptance callback is an attacker-controlled revert primitive; check whether queue entries can be canceled or skipped before assuming liveness.