# Dust griefing blocks state transitions

Can a cheap permissionless write park shared or per-user state so a legitimate transition reverts?

_Area: Smart contract access control and control flow. Seen in 17 disclosed reports; latest 2025-02-17. Updated 2026-10-23._

## How it works
A protocol assumes a state transition (full exit, account creation, slot registration, buyout, claim, migration) is reachable by the legitimate user. An attacker makes a cheap, permissionless write that leaves state at a boundary the transition logic rejects: totalSupply just above zero, an account that already exists, a capped array already full, a block marker already set, a single active proposal already occupied, a warm-up clock just refreshed, a locked dust balance on a strategy. The legitimate path then reverts. The block persists because the write is permanent (undeletable account [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-12.md)) or cheap to repeat (dust share [E1](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-10.md), junk registration [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-3.md), 1-wei buyout [E6](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AM-12.md), 1-wei stake [E7](https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-02.md), locked dust [E8](https://bugbountylibrary.com/r/c4%3A2022-06-badger%3AM-03.md)). The asymmetry: the attacker pays dust, the victim loses a transition they may never recover.

## Where it shows up
- Minimum-totalSupply or minimum-balance check evaluated on every deposit/withdraw [E1](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-10.md)
- Module gating on "account does not exist" where any send auto-creates it [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-12.md)
- Permissionless registration into a fixed-length per-key array with no value floor [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-3.md)
- Per-address anti-abuse mapping written from a caller-supplied recipient, not msg.sender [E4](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.2.md)
- Mint/registration gated on a stored counter that can stay zero after a successful write [E5](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-05.md)
- "One active proposal" state machine with no minimum stake or bid [E6](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AM-12.md)
- Per-beneficiary state overwritten by a caller-named recipient [E7](https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-02.md)
- Migration/withdraw guard requiring an externally-influenceable balance to be zero [E8](https://bugbountylibrary.com/r/c4%3A2022-06-badger%3AM-03.md)

## How to review
For each transition, ask: can an unprivileged party write the state it reads, at a cost far below the harm? The invariant: no permissionless write may leave shared or per-user state in a configuration that makes a legitimate transition revert. Distinguish boundary-rejection (the transition logic rejects a legal-looking state) from an invariant trap (a branch assumption was never true); both are griefable but fixed differently. Cost-vs-harm heuristic: if the attacker's write costs dust and the victim's blocked transition moves real value or is permanent, treat it as a finding. Check minimums are symmetric on entry and exit [E1](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-10.md), existence gates cannot be pre-satisfied [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-12.md), capped arrays have a value or whitelist floor [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-3.md), every mapping write is keyed on msg.sender [E4](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.2.md), zero-valued writes cannot satisfy a positive-power gate [E5](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-05.md), single-active-slot guards carry a minimum stake [E6](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AM-12.md), per-beneficiary state is not overwritten by a caller-named recipient [E7](https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-02.md), and guards do not require an attacker-donatable balance to be zero [E8](https://bugbountylibrary.com/r/c4%3A2022-06-badger%3AM-03.md).

## Variants seen
- Dust share holder parks totalSupply at the boundary, blocking last withdrawer [E1](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-10.md)
- Dust send pre-creates account, permanently blocking vesting creation [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-12.md)
- Junk registrations fill a 5-slot cap across periods [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-3.md)
- Third party poisons a victim's block marker via depositFor [E4](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.2.md)
- Dust contribution rounds voting power to zero, minting the NFT and blocking the real contribution [E5](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-05.md)
- 1-wei buyout occupies the single active slot for the full period [E6](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AM-12.md)
- 1-wei stake to a victim resets their warm-up clock, locking claims [E7](https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-02.md)
- Donated locked dust breaks the zero-balance migration guard [E8](https://bugbountylibrary.com/r/c4%3A2022-06-badger%3AM-03.md)

## Impact and severity
Locked funds, blocked withdrawals, permanent DoS of vesting or rewards, and blocked strategy migration. Severity rises when the block is permanent (undeletable accounts [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-12.md)) or cheap to sustain, and when it hits shared state affecting all users rather than one.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-10.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-12.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AM-3.md
- E4: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.2.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-05.md
- E6: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AM-12.md
- E7: https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-02.md
- E8: https://bugbountylibrary.com/r/c4%3A2022-06-badger%3AM-03.md