# Expired or disabled entry still authorizes

Expiry, blacklist, or disable checks that fall through to allow instead of denying

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2024-05-14. Updated 2026-11-02._

## How it works
A gate that is supposed to deny access stops denying once its entry changes state — it expires, is removed, or is toggled off. The check either returns the wrong default on that state, or is missing from one of two functions that guard the same resource. The broken assumption is that "not currently listed as blocked" means "allowed." When the deny entry lapses, the code falls through to the permissive branch instead of the safe default, so a previously blocked actor gains access, or a disabled asset stays reachable through one path while another path is closed.

## Where it shows up
- Permission enums with per-branch expiry logic; a branch returning a hardcoded `true` where sibling branches return a default expression [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md)
- Registries with both add and remove operations, and downstream `isRegistered`/membership checks [E2](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md)
- Paired functions gating the same resource (withdraw vs. return/replenish) where only one enforces an enabled flag [E3](https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-01.md)
- Any `expiration`/`expires_at` field whose comparison result feeds an allow/deny decision
- Blacklist, allowlist, sanctions, and strategy-token enable/disable toggles

## How to review
For each gate, write down the state machine: what each entry state (active, expired, removed, disabled) should yield, and confirm the code returns exactly that. The invariant: **the deny state must map to the safe default, and every function touching the resource must enforce the same guard.**
- Compare every branch of a permission enum against its siblings; a branch returning a constant instead of the shared default expression is suspect [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md)
- For registries, ask whether removed-but-still-live entities must pass membership checks, and whether removal actually stops them operating [E2](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md)
- For paired functions, diff their guards line by line; an enabled check on one path but not the other is asymmetric access [E3](https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-01.md)
- Check that expiry reverts to the default (no permission), not to a more permissive state

## How finders spotted it
- Read the permission enum branch by branch; noticed `Blacklisted` returned `true` on expiry while `Limited` and `Whitelisted` returned `!strict`, an inconsistency implying expired blacklist should revert to default [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md)
- Traced `createEscrow`'s registration check against the `removeMarket` lifecycle; removed markets still operate but fail the check [E2](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md)
- Compared `manage()` against `replenishReserves()` access checks; `manage()` omitted the enabled-token check the other enforced [E3](https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-01.md)

## Variants seen
- Expired blacklist escalates to full permission on strict actions [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md)
- Removed market fails a membership check, breaking sanctions enforcement so lenders keep interacting [E2](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md)
- Disabled strategy token still withdrawable while replenishment is blocked, trapping funds [E3](https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-01.md)

## Impact and severity
Privilege escalation from blacklisted to whitelisted-equivalent access on strict actions such as NFT minting [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md); sanctions immunity letting sanctioned lenders keep operating [E2](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md); trapped funds from asymmetric disable [E3](https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-01.md). Impact rises when the lapsed entry guards a compliance or safety control, and when the permissive path is reachable by the very actor the entry was meant to stop.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-9.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-01.md