# Inverted boolean in authorization checks

Auth guards combining flags or conditions with wrong operator or negation, letting invalid callers pass

_Area: Smart contract access control and control flow. Seen in 4 disclosed reports; latest 2025-08-21. Updated 2026-10-23._

## How it works
An authorization or validity guard is meant to reject a caller or input unless every required condition holds. The bug is in how those conditions are combined: the wrong boolean operator (`&&` where `||` is needed, or vice versa), a contradictory comparison, or a hardcoded return that ignores the default state. The guard then either never rejects (condition unsatisfiable) or rejects only in a narrow case, so an invalid caller or malformed input passes as if authorized. The broken assumption is that the guard's expression matches its stated intent; the code compiles and looks plausible, so review must check the logic, not the syntax.

## Where it shows up
- Guards ANDing two independent identity conditions (owner and id, caller and tag) where either mismatch alone should reject [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-05.md).
- Paired validation checks on the same variable where one uses `!=` and the sibling uses `==`, or a `!=`/`==` contradiction that can never be true [E2](https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AM-13.md).
- Permission enums or role branches whose expiry/fallback return differs from sibling branches (hardcoded `true` vs a default expression) [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md).
- A shared trailing assertion (time, state, expiry) applied after an `any`/OR of several violation branches, gating all of them on one condition [E4](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.5.md).

## How to review
For each guard, state the invariant in words: "reject unless A and B both hold" or "reject if any violation holds." Then verify the expression enforces exactly that. Test each condition in isolation: does a valid owner with a stale/foreign id pass [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-05.md)? Can the comparison ever be true [E2](https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AM-13.md)? Does each enum branch return the same default on expiry [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md)? Does every violation branch survive the downstream assertion [E4](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.5.md)? Compare sibling checks for asymmetry; a mismatch on the same variable signals a mistyped branch.

## Variants seen
- `&&` instead of `||` between two mismatch conditions, bypassing a time gate [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-05.md).
- Unsatisfiable `!= x && == y` comparison accepting all inputs [E2](https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AM-13.md).
- Expired blacklist returning `true` instead of the default, escalating privilege [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md).
- Unconditional expiry assertion gating all penalty branches, so violators escape [E4](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.5.md).

## Impact and severity
Consequences ranged from corrupted debt/collateral accounting [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-05.md) and bypassed attestation validity checks [E2](https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AM-13.md) to privilege escalation for blacklisted users [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md) and unenforced penalties [E4](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.5.md). Severity is high where the guard protects funds or identity; worse when the bypass is silent and downstream state is re-credited or trusted.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-05.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AM-13.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md
- E4: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.5.md