# Front-run mutable parameter before use

Config setters, penalty ratios, or expiry checks that read live state an unprivileged actor can move first

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2024-06-12. Updated 2026-10-24._

## How it works
A check or update reads a value that someone else can change between the moment the caller decides to act and the moment the transaction executes. The code assumes the state it validated against is still true at execution. An unprivileged actor moves that state (a balance, an earnings figure, an expiry) in a prior transaction, so the check reverts, the penalty is masked, or a claim is blocked. The invariant "the value I checked is the value I act on" does not hold across transactions.

## Where it shows up
- Setters that compare an input to a live token balance or other externally mutable quantity [E1](https://bugbountylibrary.com/r/c4%3A2023-08-pooltogether%3AM-08.md)
- Penalty or health metrics computed as a live ratio from current balances, recomputed on every action [E2](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.7.md)
- Time-bound mutations (renew/extend/transfer) that omit the same expiry+grace check the claim path enforces [E3](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-04.md)
- Any owner or counterparty action whose outcome depends on state an unrelated caller can touch first

## How to review
For each check, ask: can an unprivileged actor change the compared value before this tx lands? The property that must hold: either the validated value is snapshotted and used atomically, or the check cannot be moved by anyone but the caller. For setters, prefer passing the expected value and reverting only on mismatch the caller controls, not on live balance. For penalty ratios, verify no second action in the same block restores the metric. For grace periods, confirm every mutation path enforces the same time bound as the claim path [E3](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-04.md).

## Variants seen
- Balance-checked config setter griefed by a 1-wei liquidation [E1](https://bugbountylibrary.com/r/c4%3A2023-08-pooltogether%3AM-08.md)
- Owner sandwiches deposits to withdraw earnings while fees mask the penalty ratio [E2](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.7.md)
- Prior owner extends an expired domain to block a new buyer's registration [E3](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-04.md)

## Impact and severity
Led to blocked configuration, owner extraction of earnings, and denial of legitimate registration. Severity rises when the mover is privileged (E2) or when the griefing is cheap and repeatable (E1, E3).

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-08-pooltogether%3AM-08.md
- E2: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.7.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-04.md