# Mutable config read mid-flow

Settlement or callback reads admin- or counterparty-mutable config that can change after the flow starts

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2026-01-05. Updated 2026-10-23._

## How it works
A flow starts under one set of parameters (price, fee, provider, eligibility cutoff) but the code re-reads those parameters from mutable storage at settlement or callback time instead of using the values captured at start. If anyone can change that storage between start and finish — an admin, a pauser, or a counterparty whose action feeds the value — the flow settles under different rules than it began with. The assumption that breaks is "config is stable for the life of a flow." It is not, because the flow spans multiple transactions and the config does not.

## Where it shows up
- Settlement/callback functions reading `provider`, `fee`, `calculator`, or manager addresses from storage rather than from a snapshot taken at initiation [E4](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-07.md).
- Auction settlement gated by a pausability modifier while the price clock keeps running [E1](https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-01.md).
- Penalty or health metrics recomputed live from balances that another action can move in the same block [E3](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.7.md).
- Multiple checks of the same conceptual invariant using different reference timestamps or comparison operators [E2](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.14.md).
- Admin setters with no guard against being called during an active flow [E4](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-07.md).

## How to review
For each multi-step flow, list every storage read in the settlement/callback path and ask: can this value change between initiation and settlement, and by whom? The invariant: all parameters that determine the outcome must be captured at flow start and used unchanged at settlement, or the flow must be blocked from settling under changed parameters. Also diff every repeated check of one invariant for identical operators and reference timestamps [E2](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.14.md).

## Variants seen
- Pause modifier blocks settlement while price decays, so settlement lands at a worse price after unpause [E1](https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-01.md).
- Boundary mismatch: locks expiring exactly at `nextTimestamp` pass one guard but are excluded from summation [E2](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.14.md).
- Live ratio recomputed per action, masked by a second action restoring it in the same block [E3](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.7.md).
- Admin config change mid-draw causes callback revert and permanent lock [E4](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-07.md).

## Impact and severity
Outcomes ranged from unintended lower closing prices [E1](https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-01.md) and corrupted vote accounting [E2](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.14.md) to owner extraction of earnings [E3](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.7.md) and permanent protocol lock with failed settlement [E4](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-07.md). Severity rises when the change is permissionless or griefable, when the flow cannot be retried, and when value settles at the altered parameter.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-01.md
- E2: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.14.md
- E3: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.7.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-07.md