# Skipped time window on first-action branch

Deadline or window checks nested in the normal branch, skipped by first-action or special-case branches

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-11-27. Updated 2026-10-23._

## How it works
A contract enforces a time window (start/end, block-number range) on its normal path, but a special branch — first action, initialization, dummy/padding row, or a distinct payment path — bypasses that check. The assumption that "every state-changing action passes the same guard" breaks: the special branch mutates state or accepts value outside the window, and downstream logic that assumes the window held then misbehaves (rewards locked, balances inflated, unconstrained columns).

## Where to show up
- A `require(block.timestamp < endTime)` (or similar) nested inside an `else` or "already initialized" branch, not at function top.
- First-action / first-stake / first-deposit branches that set state before the guard runs.
- Payment or settlement paths that validate block number only on one side of a request lifecycle.
- zkVM/AIR rows where a validity flag (`is_valid`) gates memory ops but bus columns (timestamp, address, value) are left free on dummy rows.
- Any guard reachable only after a default/zero-state check.

## How to review
Trace every state-mutating path against the window guard. The invariant: the time/block-number check must dominate all paths that change balances, shares, or bus-relevant state, including the zero/default-state path. For each branch, ask whether the guard executes before any write. For AIRs, confirm padding rows constrain timestamp/address/value independently of `is_valid`. For payment flows, confirm both "before" and "after" request windows are provable.

## Variants seen
- First-stake branch skips `endTime`, locking rewards [E3](https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AM-04.md).
- Self-payment with future reference before `firstUnderlyingBlock` is unprovable, inflating balance [E2](https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-02.md).
- Dummy ALU rows leave register-read columns unconstrained, enabling arbitrary timestamps [E1](https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.3.md).

## Why fixes fail
E3's guard existed but was misplaced in a branch; E2's two challenges each covered one window but not the gap between them. Partial coverage leaves the special path open.

## Impact and severity
Locked rewards, inflated balances that evade challenge, and unconstrained prover state. Severity rises when the skipped check is the only barrier between an attacker and permanent fund or accounting corruption.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.3.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-02.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AM-04.md