# Permissionless refresh front-run

Anyone can trigger a refresh or retry that changes pricing or redemption terms before a victim's action

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2024-12-23. Updated 2026-10-23._

## How it works
A protocol exposes a permissionless function that recomputes state affecting price, rewards or redemption terms (a basket refresh, a randomness retry, a reward decode). The function trusts inputs or timing that an outsider can change first. The victim's transaction then executes against terms the attacker chose, not the terms the victim saw when submitting. The broken assumption is that "anyone can call it" is harmless because the refresh is neutral; in fact the caller controls when it lands relative to other pending actions.

## Where it shows up
- Permissionless refresh/retry/swap functions that change pricing, collateral mix, or randomness source [E2](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-01.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-04.md)
- Execution paths that trust encoded expected state (tick, liquidity) without re-reading actual pool state [E1](https://bugbountylibrary.com/r/cantina%3Asorella_november2024%3A3.1.1.md)
- Guards using strict equality (`==`) to set a timestamp, so later increments skip the update [E2](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-01.md)
- Sibling functions gating on an older timestamp instead of the freshest one [E2](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-01.md)
- Redemption checks that test only "not DISABLED" rather than full collateralization [E3](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-04.md)
- Reward math that charges or credits based on totalSupply at call time [E3](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-04.md)

## How to review
For every permissionless state-changing function, ask: does a caller gain by ordering it just before someone else's transaction? The invariant: any value a victim relies on (price, collateral ratio, randomness, reward share) must be either re-validated at execution time against actual state, or fixed at the moment the victim commits. Check that guards compare against the freshest timestamp, not a stale one [E2](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-01.md); that encoded expected state is compared to live pool state [E1](https://bugbountylibrary.com/r/cantina%3Asorella_november2024%3A3.1.1.md); and that redemption eligibility requires full collateralization, not merely a non-disabled status [E3](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-04.md).

## Variants seen
- Reward accounting trusts bundle-encoded tick/liquidity; front-run liquidity move misattributes rewards [E1](https://bugbountylibrary.com/r/cantina%3Asorella_november2024%3A3.1.1.md)
- Strict-equality timestamp guard lets a front-run retry() slip past swapSource()'s check, yielding two randomness requests [E2](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-01.md)
- Permissionless basket refresh during collateral disable converts a full redemption into a dust prorata payout [E3](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-04.md)

## Impact and severity
High: disproportionate reward theft [E1](https://bugbountylibrary.com/r/cantina%3Asorella_november2024%3A3.1.1.md), attacker-favorable randomness enabling jackpot theft [E2](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-01.md), and near-total loss of redemption value [E3](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-04.md). Severity rises when the refresh is cheap, permissionless, and lands in the same block as the victim's action; MEV searchers make this routine.

## Why fixes fail
Guarding only one entry point leaves the sibling path open: fixing retry() without making swapSource() gate on lastRequestTimestamp still allows the double request [E2](https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-01.md). Checking status flags instead of the underlying economic condition (full collateralization) leaves the hot-swap viable [E3](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-04.md).

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Asorella_november2024%3A3.1.1.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-04.md