# Permissionless state squatting blocks actions

Can an unprivileged caller pre-create, seed, or force a slot, pair, id, or bit a legitimate action needs?

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-08-20. Updated 2026-10-24._

## How it works
A protocol assumes a slot, pair, id, or per-user bit is either protocol-created or only changed with the owner's consent. When creation or mutation is permissionless, an attacker can occupy that state first, or force it onto a victim, so the later legitimate action reverts, is silently altered, or is permanently blocked. The broken assumption is provenance or consent: "exists and is empty" is treated as "ours", and "recipient" is treated as "agreed".

## Where it shows up
- Functions that accept a caller-chosen receiver and force a state change (delegation, collateral flag) on it [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-05.md)[E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-07.md).
- Zero-amount calls that still mutate delegation or accounting [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-05.md).
- Dust transfers that auto-set a per-user config bit, saturating a fixed bitmap [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-07.md).
- Existence/emptiness checks used as proof of protocol ownership where pair creation is permissionless [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-05.md).
- Pair addresses visible via events or mempool before the legitimate creation step [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-05.md).

## How to review
For each slot, pair, id, or bit a later action needs, ask: who can create or mutate it, and is that gated by consent or provenance? The invariant: a legitimate action must not be blockable or silently changed by an unprivileged third party. Check that forced state changes require the affected party's consent, that zero/dust amounts cannot mutate tracked state, and that ownership is proven by a protocol record rather than by emptiness. For auto-set config bits, confirm the recipient opted in before the bit flips, and that the per-user cap cannot be saturated by ordinary transfers [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-07.md).

## Variants seen
- Forced delegation via zero-amount sponsor with caller-chosen receiver, forcing the victim's delegation to the sponsor address and zeroing voting power [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-05.md).
- Auto-set recipient collateral bit on dust transfer saturating a per-user reserve bitmap [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-07.md).
- Pre-created and dust-seeded LP pair defeating a zero-balance ownership check [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-05.md).

## Impact and severity
Outcomes ranged from loss of voting power [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-05.md) and blocked supplies/liquidations [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-07.md) to denial of pool launch [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-05.md). Severity rises when the squatting is cheap (dust, zero-value calls) and hits liquidation paths where blocked actions strand funds [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-07.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-05.md
- E2: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-07.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-05.md