# BlockSpecimenProofChain::submitBlockSpecimenProof Block specimen producer can greatly reduce session duration by submitting fake block specimen in the future

Block specimen producer starts a session for a future block height, halving the honest submission window for that block.

- Payout: Contest reward
- Severity: medium
- Program: Covalent
- Credited: cergyk
- Disclosed: 2023-11-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-11-covalent-judging/issues/79
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-covalent%3AM-8
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** BlockSpecimenProofChain.submitBlockSpecimenProof staking contract
**Root cause:** Session deadline is set from current block.number when the first specimen arrives, regardless of the target block height, so submitting for a future height starts the session early.
**Steps:**
1. Call `submitBlockSpecimenProof` with a `blockHeight` up to `allowedThreshold` (default 100) blocks in the future.
2. Session starts immediately with `sessionDeadline = block.number + _blockSpecimenSessionDuration` (~240 blocks).
3. Honest producers can only submit after the real block exists, losing up to ~100 of the 240 blocks of window.
**How found:** Code reading of session initialization in submitBlockSpecimenProof; noticed deadline derives from current block.number not the target block's estimated timestamp, and compared allowedThreshold (100) against session duration (~240).
**Exploitation:** Malicious producer submits an invalid specimen for a future block height, starting the session clock early and shrinking the honest participation window by up to half.
**Insight:** When a session/deadline is anchored to the submission transaction's block rather than the target block's timestamp, check whether a future-dated target can pre-start the clock and shrink the honest window.