# is_permissioned() may underflow

Andromeda ADO is_permissioned consumes a Limited permission use even when the action no longer requires permission, underflowing uses=0 and blocking execution.

- Payout: Contest reward
- Severity: medium
- Program: Andromeda Ado
- Credited: Kow
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-andromeda-ado-judging/issues/46
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-8
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:rust technique:source-review vuln:access-control vuln:business-logic

**Target:** Rust ADO contract permissioning module (is_permissioned)
**Root cause:** is_permissioned() calls permission.consume_use() for Limited permissions regardless of whether permissioned_action is true, so a Limited permission with uses=0 underflows when the action is toggled to not require permission.
**Steps:**
1. Admin sets action1 permissioned_action=true and grants alice Permission::Limited with uses=3.
2. Alice consumes all 3 uses, leaving Limited.uses=0.
3. Admin toggles action1 permissioned_action=false.
4. Alice calls action1; is_permissioned matches Limited and calls consume_use(), underflowing uses=0-1 and reverting.
5. Action1 cannot be executed by alice despite no longer requiring permission.
**How found:** Code reading of is_permissioned() noting consume_use() runs unconditionally for Limited permissions, then reasoning about the state transition where permissioned_action flips to false after uses are exhausted.
**Insight:** When a permission/allowance counter is decremented, check whether the decrement is gated on the same condition that made the counter relevant; state transitions (admin toggling requirements) can leave counters at zero and cause underflow reverts that lock users out.