# Privileged path bypasses enforced guard

Owner or child path that skips timelock, pause, or parent fuse the main path enforces

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-05-28. Updated 2026-10-31._

## How it works
A contract enforces a safety guard on its main path (a timelock, a pause, a fuse that constrains a parent), but a second privileged path — an owner-only function, a child action, or an early return — reaches the same state without that guard. The assumption that "the guard covers every route to the protected state" breaks because the guard is applied per-path rather than as an invariant over the state itself.

## Where it shows up
- Owner-only or admin functions that release, mint, or transfer assets without the per-user timelock the normal path applies [E2](https://bugbountylibrary.com/r/dhl%3A20260528-dxsale.md).
- Child-side flags that constrain a parent (e.g. a child fuse implying a parent fuse) where the parent's own state is never updated [E1](https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-03.md).
- Early returns in accounting code that skip a pause or guard when a computed amount is zero [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.11.md).
- Unverified bytecode with selectors not in the documented ABI; silent multi-hop ownership transfers [E2](https://bugbountylibrary.com/r/dhl%3A20260528-dxsale.md).
- Unwrap/re-wrap or deregister/re-register cycles that reset child state [E1](https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-03.md).

## How to review
Enumerate every path that can reach the protected state and confirm each one applies the guard, or that the guard is enforced as a state invariant independent of path. For fuse-style constraints, verify the implication holds transitively to the root, including after unwrap/re-wrap. For fixes, list the boundary conditions the new guard depends on and test the complementary state [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.11.md). For legacy contracts, decode selectors and diff against the ABI; trace ownership history [E2](https://bugbountylibrary.com/r/dhl%3A20260528-dxsale.md).

## Variants seen
- Parent fuse not burned when child burns its constraining fuse, enabling re-registration [E1](https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-03.md).
- Owner backdoor function bypassing per-user timelocks on locked LP [E2](https://bugbountylibrary.com/r/dhl%3A20260528-dxsale.md).
- Early return on zero amount skips pause during full slash while all positions unwind [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.11.md).

## Why fixes fail
E3's prior fix only paused when a non-unwinding locked position existed, missing the all-unwinding plus full-slash case; the guard's precondition was too narrow.

## Impact and severity
Critical: ~$7.3M drained via owner backdoor [E2](https://bugbountylibrary.com/r/dhl%3A20260528-dxsale.md); ownership and fuse seizure of subdomains [E1](https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-03.md); locked tokens minted that can never be unwound [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.11.md). Severity rises when the bypass is owner-reachable and the guarded asset is high-value or irreversible.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-03.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260528-dxsale.md
- E3: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.11.md