# Permissionless write invalidates pending action

Can anyone mutate state or squat an ID that a pending tx or creation depends on?

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2023-11-16. Updated 2026-10-23._

## How it works
A flow assumes that a value it reads or an identifier it uses will still be valid when its transaction lands. But some other function lets any caller change that value, or claim that identifier, first. Because pending transactions are visible before they execute, an attacker can act on the shared state ahead of the victim. The victim's transaction then either reverts or proceeds with a degenerate value. The broken assumption is that state read at execution time is the same state the caller intended.

## Where it shows up
- A permissionless function whose return value another flow consumes as a meaningful amount (e.g. a reward figure).
- A struct whose `keccak256` hash is used as an integrity check, where any caller can mutate the struct.
- Caller-supplied identifiers (IDs, names) that are uniqueness-checked on-chain and revert on collision.
- Functions that early-return a default (0/empty) on a second call within a window.
- Any create/validate/distribute path whose inputs are mempool-visible and cheaply pre-emptable.

## How to review
For each pending action, list every piece of state it reads or depends on, then ask who can write that state and at what cost. The invariant: no party other than the legitimate actor (or a trusted, gated role) can change a dependency between the moment the action is submitted and the moment it executes. Check that:
- Values consumed by a flow are computed inside that flow, not fetched from a permissionless function an attacker can pre-call.
- Integrity hashes cover only fields the legitimate actor controls, or mutation is access-gated.
- Identifiers are assigned in-protocol or namespaced per caller, not taken from user input and collision-checked.

## Variants seen
- Pre-calling a permissionless emitter so its return is 0, zeroing an epoch's rewards [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-52.md).
- Mutating a struct with a 1-wei call to change its hash, invalidating a pending validation [E2](https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AM-02.md).
- Squatting a user-supplied vault ID to block legitimate creation [E3](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-01.md).

## Impact and severity
Led to reward starvation, blocked auctions/repayment, and denial of vault creation [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-52.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AM-02.md)[E3](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-01.md). Severity rises with how cheap the griefing call is and how many flows depend on the mutated value.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-52.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AM-02.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-01.md