# Permission checks will unnecessarily consume Limited uses

Andromeda permissioning consumes Limited permission uses for both origin and previous_sender on a single check, draining uses 2-4x faster than intended.

- Payout: Contest reward
- Severity: medium
- Program: Andromeda Ado
- Credited: g
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-andromeda-ado-judging/issues/27
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-2
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:rust technique:source-review vuln:access-control vuln:business-logic

**Target:** CosmWasm ADO permissioning module (permissioning.rs)
**Root cause:** is_context_permissioned() calls is_permissioned() separately for origin and previous_sender, and each call consumes a Limited permission use even though only one authorization is needed.
**Steps:**
1. Set up a Limited permission for an address with N uses.
2. Trigger an execute/mint via AMP where origin and previous_sender are the same or both Limited-permissioned addresses.
3. Observe is_context_permissioned() invokes is_permissioned() twice, each calling permission.consume_use() and saving state.
4. Confirm 2-4 uses are consumed for a single action instead of 1.
**How found:** Code reading of is_permissioned() and is_context_permissioned() revealed consume_use() is called unconditionally per address checked, and that both origin and previous_sender are checked for one action.
**Exploitation:** A whitelisted user can route AMP messages so a target address appears as origin or previous_sender, forcing consumption of that address's Limited uses and causing premature exhaustion/DoS of permissioned actions.
**Insight:** When auditing permission/allowance systems, check whether multi-actor authorization paths (origin vs sender) each decrement a shared quota; a single logical action should consume one use, not one per checked identity.