# commitRequested() front-run  malicious invalid oralce

Anyone can front-run commitRequested() with a crafted commit() call that bumps lastCommittedPublishTime, making the keeper's commitRequested() revert and stalling oracle updates.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: bin2chen
- Disclosed: 2023-09-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-09-perennial-judging/issues/27
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-2
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos vuln:oracle-manipulation

**Target:** PythOracle.sol commit()/commitRequested() oracle commit flow
**Root cause:** commit() and commitRequested() share the lastCommittedPublishTime monotonicity check, so a commit() call with a slightly older oracleVersion but newer publishTime advances the timestamp and blocks the pending commitRequested().
**Steps:**
1. Observe keeper tx commitRequested(versionIndex=10, VAA{publishTime=205}) in mempool with versionList[10]=200, _latestVersion=100.
2. Front-run with commit(versionIndex=10, oracleVersion=199, VAA{publishTime=205}).
3. commit() passes: versionIndex==nextVersionIndexToCommit, oracleVersion=versionList[10]-1 > _latestVersion, publishTime >= versionList[10]-1+MIN_VALID_TIME_AFTER_VERSION.
4. commit() sets lastCommittedPublishTime=205.
5. Keeper's commitRequested() reverts with PythOracleNonIncreasingPublishTimes since publishTime<=lastCommittedPublishTime.
**How found:** Code reading of the shared lastCommittedPublishTime check in both commit() and commitRequested(), noticing commit() can be satisfied with oracleVersion=versionList[versionIndex]-1 while still advancing publishTime, enabling a front-run that invalidates the pending commitRequested().
**Exploitation:** Attacker watches the mempool for keeper commitRequested() calls and submits a commit() with oracleVersion one below the requested version but a publishTime equal to or newer than the keeper's VAA, consuming the publishTime slot and forcing the keeper's tx to revert; repeated front-running can delay oracle updates until the VAA expires.
**Insight:** When two entrypoints share a monotonicity guard on the same state variable, check whether the less-restricted entrypoint can be invoked to consume the guard's slot and grief the intended path; here commit() accepts an older oracleVersion but a newer publishTime, letting an attacker advance lastCommittedPublishTime ahead of the keeper.