# Replay window exceeds action period

Check whether a commit, claim or withdrawal window outlasts the action it guards, letting it be replayed or double-counted.

_Area: DeFi accounting and math bugs. Seen in 7 disclosed reports; latest 2025-02-20. Updated 2026-10-23._

## How it works
A contract lets an action be retried, refunded or counted while the state it depends on has already moved on. The broken assumption is that a window (commit, grace, claim, withdrawal lock) is shorter than, or exactly aligned with, the period of the action it protects. When the window is longer, or two windows are independent, the same event can be processed twice, or a second event can land after the first has already paid out. The result is supply, balances or rewards that no longer match what the contract actually holds.

## Where it shows up
- A commit/execute window longer than the buyout or challenge period it guards [E3](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-15.md).
- Two independent timers (challenge vs withdrawal lock) where either can elapse first [E6](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AM-2.md).
- Boundary operators that disagree: `<=` on the claim side, `>=` on the reclaim side, at the same timestamp [E7](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-06.md).
- Self-referential messages where `from == to` or the contract's own chain/handler is whitelisted [E1](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AM-09.md).
- A user-supplied ID whose timestamp bounds a reward window, with no eligibility check [E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-nouns-dao-2%3AH-1.md).
- Deterministic IDs hashed only from block-scoped values, shared across contracts [E4](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md).
- Upgrade-boundary checks that only cover pre-upgrade batches [E5](https://bugbountylibrary.com/r/c4%3A2024-03-zksync%3AM-04.md).

## How to review
The invariant: for every action that can be replayed, refunded or counted, the guard window must be strictly shorter than the action period, and the "expired" and "still valid" checks must use complementary operators at the same boundary. Concretely:
- Compare every timeout constant against the period it protects; flag any overlap [E3](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-15.md)[E6](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AM-2.md).
- Confirm claim and reclaim predicates cannot both be true at one timestamp [E7](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-06.md).
- Reject `from == to` and self-whitelisted handlers [E1](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AM-09.md).
- Validate any ID used to derive a timestamp for eligibility before consuming it [E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-nouns-dao-2%3AH-1.md).
- Include contract address and a nonce in ID generation [E4](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md).
- Check upgrade-batch boundary conditions explicitly [E5](https://bugbountylibrary.com/r/c4%3A2024-03-zksync%3AM-04.md).

## Variants seen
- Commit replay after failed buyout draining ETH [E3](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-15.md).
- Slashing an already-withdrawn staker, leaving accounting insolvent [E6](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AM-2.md).
- Double-counting a claimed jackpot as unclaimed [E7](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-06.md).
- Self-bridge re-minting locked supply [E1](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AM-09.md).
- Front-running a proposal to extend a reward window [E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-nouns-dao-2%3AH-1.md).
- ID collision enabling double refund [E4](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md).
- Double withdrawal across old and new bridges [E5](https://bugbountylibrary.com/r/c4%3A2024-03-zksync%3AM-04.md).

## Impact and severity
Funds drained from migration or staking contracts, inflated token supply, stolen rewards, and protocol insolvency. Severity rises when the window is user-triggerable and cheap to enter, and when accounting credits value against assets no longer held [E6](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AM-2.md)[E7](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-06.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AM-09.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-03-nouns-dao-2%3AH-1.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-15.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-03-zksync%3AM-04.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AM-2.md
- E7: https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-06.md