# is_permissioned() It doesn't make sense to have permissions by default after Blacklisted expires.

Expired Blacklisted permission returns true in is_permissioned(), granting previously blacklisted users access to strict permissioned actions like NFT minting.

- Payout: Contest reward
- Severity: medium
- Program: Andromeda Ado
- Credited: bin2chen
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-andromeda-ado-judging/issues/47
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9
- Tags: domain:web3 impact:privesc kind:contest platform:sherlock sev:medium tech:rust technique:source-review vuln:access-control vuln:business-logic

**Target:** CosmWasm permissioning module (is_permissioned)
**Root cause:** Blacklisted(expiration) branch returns true unconditionally when expired, instead of !strict like Limited and Whitelisted branches, so an expired blacklist escalates the user to full permission.
**Steps:**
1. Admin blacklists alice with Permission::Blacklisted(Some(expiration)) on an action.
2. Wait until expiration passes.
3. Admin sets the action to strict (requires permission).
4. Call is_permissioned(alice, strict=true): Blacklisted branch hits `if expiration.is_expired(&env.block) { return true; }`.
5. alice is now permitted on a strict action, e.g. minting NFTs in the NFT ADO.
**How found:** Code reading of the permissioning enum: noticed Blacklisted returns true on expiry while Limited and Whitelisted return !strict, an inconsistency suggesting expired blacklist should revert to default (no permission) rather than grant access.
**Exploitation:** A previously blacklisted user waits out the blacklist expiration; once the action becomes strict-permissioned, is_permissioned returns true and the user can invoke privileged actions (e.g. NFT minting) without being whitelisted.
**Escalation:** Privilege escalation from blacklisted to whitelisted-equivalent access on strict actions.
**Insight:** When auditing permission enums, compare each branch's expiry/fallback return value against the others; a branch returning a hardcoded true instead of the default-state expression is a privilege-escalation smell.