# Async step without timeout or retry

One-shot cross-component or RPC calls with no timeout, ack check, or retry that can strand state

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-10-29. Updated 2026-10-23._

## How it works
A step that depends on another component (an RPC node, a peer, an operator) is fired once and assumed to succeed. The code either never waits for the acknowledgement it actually needs, never bounds how long it waits, or treats every failure the same. When the assumption breaks — the ack is late, the connection stalls, the error is transient — the step is lost or duplicated and the surrounding state machine has no path back to a correct state.

## Where it shows up
- A trigger guard that checks fewer preconditions than the on-chain transaction or message actually requires [E1](https://bugbountylibrary.com/r/cantina%3Aclementine_aug2025%3A3.1.2.md).
- A send/announce path executed once, with no retry or re-arm after an invalid or failed attempt [E1](https://bugbountylibrary.com/r/cantina%3Aclementine_aug2025%3A3.1.2.md).
- Network clients built without read or total timeouts (e.g. a default HTTP client swapped in for one with a timeout) [E4](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.2.md).
- Retry logic that branches on "any error" rather than a specific not-found error [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-3.md).
- Truthiness checks on user-supplied arguments where emptiness, not truth, is the real condition [E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.8.md).

## How to review
For each async step, list every precondition the downstream transaction or message needs, then confirm the trigger guard checks all of them, including receipt of acks/preimages [E1](https://bugbountylibrary.com/r/cantina%3Aclementine_aug2025%3A3.1.2.md). Confirm the step can be retried or re-armed after failure, and that retries are idempotent. Check that every outbound client sets an explicit timeout and that retry decisions distinguish transient errors from definitive "not found" [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-3.md)[E4](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.2.md). The invariant: a one-shot send must only fire when all its inputs are present, and any failure must leave state that can be retried safely.

## Variants seen
- Premature send before required acks arrive, never retried [E1](https://bugbountylibrary.com/r/cantina%3Aclementine_aug2025%3A3.1.2.md).
- Truthiness check on a user-controlled list steering control flow into the wrong branch [E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.8.md).
- Over-broad error handling causing duplicate submission and blocking resubmission [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-3.md).
- Missing timeouts in a forked RPC client freezing all dependent components [E4](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.2.md).

## Impact and severity
Ranged from duplicate/blocked transactions [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-3.md) to a full freeze of sequencer, node, prover and light client [E4](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.2.md), and to bridge fund theft when a malicious operator exploits the missing ack check [E1](https://bugbountylibrary.com/r/cantina%3Aclementine_aug2025%3A3.1.2.md). Severity rises when the stuck step guards funds or when one stalled dependency is shared across many components.

## Why fixes fail
Fixes that only add a retry without fixing the guard still resend an invalid transaction [E1](https://bugbountylibrary.com/r/cantina%3Aclementine_aug2025%3A3.1.2.md); fixes that only widen error handling can mask transient failures [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-3.md).

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Aclementine_aug2025%3A3.1.2.md
- E2: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.8.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-3.md
- E4: https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.2.md