# Concurrent registration overwrites shared mapping

Registration writes keyed by logical identity with blind overwrite and no session or uniqueness binding

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2026-05-04. Updated 2026-10-23._

## How it works
A registration or upload path writes into a shared mapping keyed only by a logical identity (token, backup+index, vault ID) and overwrites whatever was there. The code assumes the write is unique or that a guard elsewhere prevents duplicates. That assumption breaks when the guard runs on a different hop, in a different session, or before the value is observable: two concurrent or replayed writes both pass the check and the last one wins, silently invalidating the earlier entry [E1](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-04.md)[E2](https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-01.md)[E3](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-01.md).

## Where it shows up
- Duplicate checks on an initiating hop, state write on a later async hop (cross-chain, queued calls) [E1](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-04.md)
- Validation of a freshly generated identifier that is trivially "not yet present" instead of the stable identifier [E1](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-04.md)
- Storage keyed by (account, backup, index) with blind overwrite while ciphertexts are bound to a per-session key [E2](https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-01.md)
- Caller-supplied IDs that are uniqueness-checked on-chain and visible in the mempool [E3](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-01.md)
- Comments asserting "versions are equivalent" where encryption or session binding contradicts it [E2](https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-01.md)

## How to review
Find every write to the shared mapping and ask: what makes this write unique, and is that property checked at the same point as the write? The invariant: for a given logical key, at most one live entry exists, and any guard is re-evaluated against the stable identifier at the state-mutating step, not an earlier hop or a regenerated value [E1](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-04.md). For session-bound data, verify() must validate the session, not just the payload [E2](https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-01.md). For caller-chosen IDs, the protocol should assign them or reserve them atomically [E3](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-01.md).

## Variants seen
- Async cross-chain registration where the duplicate guard is stale by the time state is written [E1](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-04.md)
- Replay of stale session-bound shares overwriting fresh ones [E2](https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-01.md)
- Front-run squatting of a user-supplied unique ID causing DoS [E3](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-01.md)

## Impact and severity
Earlier entries become unreachable: bridged tokens invalidated and deposits lost [E1](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-04.md), recovery permanently blocked [E2](https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-01.md), legitimate creation denied [E3](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-01.md). Severity rises with irreversibility and with how cheap the overwriting write is; mempool visibility and async hops widen the window.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-04.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-01.md