# Cheap griefing blocks legitimate transition

Permissionless dust action parks state so a legitimate deposit, liquidation, or claim reverts

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2023-08-09. Updated 2026-10-24._

## How it works
A legitimate transition (auction close, liquidation, claim) depends on a condition that a permissionless, near-zero-cost action can shift. The attacker does not need to profit directly; they only need to make the legitimate caller's precomputed inputs invalid or to suppress competing actors for a short window. The broken assumption is that state read at execution matches state at submission, or that a small fixed window is long enough to be contested.

## Where it shows up
- Validation compares a caller-supplied amount against a bound recomputed from live state (e.g. `maxClose` from current `borrowBalance`) [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-08.md)
- Auction/close logic gated only on `block.number > highestBidBlock + nextBidderBlockLimit` with a small fixed window [E1](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-01.md)
- Claim/mint functions callable by anyone for any beneficiary, with caller-supplied split arrays [E2](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-04.md)
- Chains with cheap block space and no private mempool, where stuffing or frontrunning is inexpensive [E1](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-01.md)

## How to review
Check the invariant: for every legitimate transition, can an unprivileged actor change the inputs or the environment cheaply enough to make it revert or to win uncontested? Specifically:
- Is any submitted amount compared to a value that can move between submission and execution? Prefer bounds fixed at submission or tolerant of intervening changes [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-08.md).
- Is an anti-sniping window a small fixed block count on a cheap-gas chain? Compare window length to realistic block-stuffing cost [E1](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-01.md).
- Does a claim/mint let the caller choose how a victim's balance is split? Require `msg.sender == beneficiary` or bound array length and per-card sizing [E2](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-04.md).

## Variants seen
- Dust repayment frontruns liquidation, shrinking `maxClose` below `repayAmount` and reverting [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-08.md)
- Block stuffing suppresses overbids so a sole floor bid wins the auction [E1](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-01.md)
- Caller-controlled split fragments a victim's voting power and inflates gas [E2](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-04.md)

## Impact and severity
Bad debt auctioned at minimum incentive [E1](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-01.md); liquidations blocked, leaving unhealthy positions [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-08.md); fragmented voting power and inflated costs for large depositors [E2](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-04.md). Severity rises where the griefing cost is near zero and the victim's action is time-sensitive.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-04.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-08.md