# Front-run mutable state before use

Value read at execution that a counterparty can rewrite after the victim commits but before the tx lands

_Area: Smart contract access control and control flow. Seen in 14 disclosed reports; latest 2025-06-30. Updated 2026-10-23._

## How it works
A transaction reads a value at execution time (price, withdrawal credentials, channel state, timelock delay, bid) and acts on it, but a counterparty can change that value in a transaction that lands first. The assumption that breaks is "the state I read is the state I execute against." The invariant: every value that sets the victim's cost, recipient, payout or outcome must be fixed at authorization, or the executing party authenticated, or a bound must reject the changed value.

## Where it shows up
- Order fill computes amount from a price field the creator can still update (`updateOrder`) [E3](https://bugbountylibrary.com/r/c4%3A2024-01-init-capital-invitational%3AH-03.md).
- Delegated staking: withdrawal credentials supplied per-call, not bound to the depositor's pubkey [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-4.md).
- Allocation accepts only a recipient id; payout later reads the counterparty's stored bid [E8](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-5.md).
- Timelock delay (`quitPeriod`) read at execution, not snapshotted at proposal [E7](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-02.md).
- Channel getters filtering only OPEN, ignoring FLUSHING/upgrade states [E5](https://bugbountylibrary.com/r/h1%3A2917368.md).
- Public `commitValSetHeader` decoupled from `setSigVerifier`, leaving a stake-exit window [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-7.md).

## How to review
For each value consumed at execution, ask: who can write it, and can they write it after the victim acts but before the tx lands? Then:
- Fills: is price/slippage committed at authorization, not read from a creator-mutable field? [E3](https://bugbountylibrary.com/r/c4%3A2024-01-init-capital-invitational%3AH-03.md)
- Staking: are withdrawal credentials bound before deposit? [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-4.md)
- Allocation: is the reviewed bid pinned in the accept call, not re-read at payout? [E8](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-5.md)
- Timelocks: is the delay snapshotted at proposal, not evaluated at execution? [E7](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-02.md)
- Channel getters: do they reject FLUSHING/upgrade, not just non-OPEN? [E5](https://bugbountylibrary.com/r/h1%3A2917368.md)
- Commit/selection: can stake be withdrawn between selection and commitment? [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-7.md)
Not a finding: the mutable value is one the caller legitimately controls and no third party can write it between act and land.

## Variants seen
- Credential capture: 1 ETH front-run with same pubkey captures 32 ETH [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-4.md).
- Mutable price: creator raises limitPrice before fill, stealing executor funds [E3](https://bugbountylibrary.com/r/c4%3A2024-01-init-capital-invitational%3AH-03.md).
- Bid inflation: registrant re-registers higher before allocation, payout follows [E8](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-5.md).
- Retroactive delay: owner shortens quitPeriod after proposing changes [E7](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-02.md).
- Channel replacement: parallel channel acked during upgrade window [E5](https://bugbountylibrary.com/r/h1%3A2917368.md).
- Stake-exit lag: operator votes without slashing risk [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-7.md).

## Impact and severity
Full ETH drain [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-4.md), stolen executor assets [E3](https://bugbountylibrary.com/r/c4%3A2024-01-init-capital-invitational%3AH-03.md), inflated payouts draining pool funds [E8](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-5.md), bypassed rage-quit window [E7](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-02.md), channel hijack [E5](https://bugbountylibrary.com/r/h1%3A2917368.md), unbacked consensus [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-7.md). Severity rises when the mutation is cheap, the victim cannot set bounds, and the loss is the full position.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-7.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-4.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-01-init-capital-invitational%3AH-03.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-09.md
- E5: https://bugbountylibrary.com/r/h1%3A2917368.md
- E6: https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-01.md
- E7: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-02.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-5.md