# Permission use counter desync

Limited-use authorization consumed per address, on no-op actions, or underflowing to zero

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2024-05-14. Updated 2026-10-24._

## How it works
A limited-use authorization is meant to be spent once per logical action. The assumption that breaks is that the counter is decremented exactly once, and only when the action actually needs authorization. When the decrement is placed unconditionally, or run once per actor checked, or run on a path where the action no longer requires permission, the counter drifts from reality: it drains faster than intended, or underflows past zero and blocks the action entirely. The same shape appears in fee/collateral accounting: a special-cased path skips the charge, so invalid work becomes free [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-aleo%3AH-1.md).

## Where it shows up
- A `consume_use()` / decrement call not gated on the same condition that made the counter relevant [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-8.md).
- Multi-actor checks (origin vs previous_sender, caller vs owner) each calling the same permission function for one action [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-2.md).
- Special-cased transaction or message types exempted from fee/collateral requirements [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-aleo%3AH-1.md).
- Fee or charge applied only inside the failing path, with no seizable backup [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-aleo%3AH-1.md).
- Counters with no floor check before subtraction.

## How to review
For each limited-use counter, enumerate every path that decrements it and confirm the invariant: one logical action consumes exactly one use, and no decrement occurs when the action does not require permission. Check that multi-actor authorization resolves to a single consumption, not one per address [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-2.md). Check subtraction is guarded against zero [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-8.md). For fee/collateral paths, confirm every submission type pays or posts something seizable before expensive verification runs, including special-cased types [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-aleo%3AH-1.md).

## Variants seen
- Double consumption: origin and previous_sender each drain a shared quota, 2-4x faster than intended [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-2.md).
- Underflow: decrement runs even after the action is toggled to not require permission, uses=0 underflows and blocks execution [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-8.md).
- Free invalid work: single split transactions skip the fee commitment, so invalid proofs cost the submitter nothing [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-aleo%3AH-1.md).

## Impact and severity
Consequences ranged from griefing/DoS of verifiers and networks [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-aleo%3AH-1.md) to legitimate actions being blocked by underflow [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-8.md) and quotas draining prematurely [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-2.md). Severity rises when the desync is attacker-triggerable at no cost and hits shared infrastructure rather than one account.

## Why fixes fail
Gating the decrement on `permissioned_action` alone is not enough if multi-actor paths still call the check per address; both conditions must hold together [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-2.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-8.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-05-aleo%3AH-1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-8.md