# Permissionless registration squats shared slot

Anyone can create or register a pair, pool, or slot that later blocks or diverts others

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-03-07. Updated 2026-10-24._

## How it works
A shared namespace (a pool, pair, or deployment slot) is created or registered by whoever calls first, and the contract assumes the legitimate party will be the one to do it. When creation is permissionless and the resulting entry is treated as canonical, an unprivileged caller can occupy the slot first. Later privileged setup either cannot run or runs against the squatter's entry, so yield, fees, or supply flow to the wrong party or stop flowing at all.

## Where it shows up
- Factory create/register functions callable by anyone, with no allowlist or caller check.
- Initialization that branches on `msg.sender` (e.g. `msg.sender == launchpad ? x : 0`), leaving a zero/default state for other callers.
- A `getPair`/registry mapping that locks the first entry as canonical and cannot be replaced.
- Hooks or harvest functions that check the caller is the hook but not which pool the funds go to.
- Token parameters (asset, coin, parent ID) accepted without validation against an expected set.
- Deployment or mint logic gated only by timing (same-block/concurrent-spend) rather than by identity.

## How to review
For every permissionless create/register path, ask: can an unprivileged caller reach the state that privileged setup later depends on? The invariant: the canonical slot must be bound to the legitimate creator, either by access control on creation, by validating the inputs (asset, coin, parent), or by making the canonical mapping settable only through the privileged path. Check that harvest/distribution targets are bound to the pool that earned them, not just to the hook caller. Check that timing-only guards also constrain the minting/creating identity.

## Variants seen
- Victim's yield-bearing vault wrapper used as pool token; harvest donates victim yield to attacker's pool [E1](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.4.md).
- Deployment mint gated only by concurrent-spend timing; attacker splices a coin into the bundle and mints majority supply [E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.7.md).
- Attacker pre-creates the token/quote pair, locking zero fee hooks so canonical market never accrues rewards [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-18.md).

## Impact and severity
Yield theft [E1](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.4.md), majority supply minted to attacker [E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.7.md), and permanent loss of staker fee distribution with no remediation because the pair is locked [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-18.md). Severity is high where the squatted slot is canonical and irreversible; worse when the diverted value is ongoing (yield, fees) rather than one-time.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.4.md
- E2: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.7.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-18.md