# State machine status check bypass

Guards reading timestamps, sentinels or shared IDs that caller input or re-init can rewrite

_Area: Smart contract access control and control flow. Seen in 162 disclosed reports; latest 2026-05-11. Updated 2026-10-23._

## How it works
A contract decides whether an action is allowed by reading stored state (a timestamp, a status flag, a sentinel, an ID link) and comparing it to a rule. The broken assumption is that this state was written by the legitimate path and cannot be rewritten or diverged from. Two shapes appear: (a) caller-writable state — a field left unset, re-initialized after finalization, or derived from caller input, so the guard passes in the wrong state; (b) protocol-internal divergence — two paths write or read the same logical state differently, so the guard's view disagrees with reality. The invariant: a guard passes only when the field it reads was written by the legitimate path, cannot be rewritten afterward, and is read consistently by every gate. The caller is often authorized; the state the guard trusts is wrong.

## Where it shows up
- Re-init paths that read the existing struct from storage before setting fields, preserving stale timestamps while overwriting sizes [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-03.md).
- Identity or inheritance checks keyed on an ID shared by rival objects rather than the specific instance [E2](https://bugbountylibrary.com/r/c4%3A2024-05-arbitrum-foundation%3AH-02.md).
- Guards that re-fetch a token/registry reference instead of using the stored one, so re-registration changes the value the guard reads [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-25.md).
- Status flags set before the guard that decides whether the residual order is persisted [E4](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-04.md).
- State derived from a value the caller writes, where a sentinel flips the derived state back [E5](https://bugbountylibrary.com/r/c4%3A2022-11-size%3AH-02.md).
- Override/update paths validating against the original record, not the latest stored one [E6](https://bugbountylibrary.com/r/c4%3A2025-11-merkl%3AM-03.md).
- Alternate entrypoints that skip the central status-check helper other paths call [E8](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-01.md).

## How to review
For each guard, trace every path that writes the field it reads. Checklist:
- Re-init/override paths write all fields and validate against the latest record, not the base [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-03.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-11-merkl%3AM-03.md).
- Timestamps are set on every path; zero is not a valid sentinel [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-03.md).
- Identity checks bind the specific instance, not a shared ID [E2](https://bugbountylibrary.com/r/c4%3A2024-05-arbitrum-foundation%3AH-02.md).
- Guards use the stored reference, not a re-fetched registry value [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-25.md).
- Status flags are set only after the persist/skip decision [E4](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-04.md).
- Derived state must not be writable by caller input; no sentinel can flip it back [E5](https://bugbountylibrary.com/r/c4%3A2022-11-size%3AH-02.md).
- Every entrypoint calls the central status-check helper [E8](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-01.md).
False positive: a status read that is only ever written by one internal path and never re-derived from input is safe. For the divergence shape, a shared ID is safe when every consumer also binds the instance (e.g. claimId==edgeId), or when only one object can ever hold that ID, or when the shared field is written once at creation and never updated by any later path.

## Variants seen
- Re-init after challenge period mutates finalized metadata [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-03.md).
- Shared mutualId lets rival edge inherit timer [E2](https://bugbountylibrary.com/r/c4%3A2024-05-arbitrum-foundation%3AH-02.md).
- Re-vote after execution re-flags executable state; re-registration changes the denomination the guard reads [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-25.md).
- Status set before residual-order guard orphans record [E4](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-04.md).
- Caller-written sentinel flips derived state [E5](https://bugbountylibrary.com/r/c4%3A2022-11-size%3AH-02.md).
- Override anchored to original record blocks later overrides [E6](https://bugbountylibrary.com/r/c4%3A2025-11-merkl%3AM-03.md).
- Flash-loan path skips the frozen-pool status check [E8](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-01.md).

## Impact and severity
In the evidence these led to stolen validator stake [E2](https://bugbountylibrary.com/r/c4%3A2024-05-arbitrum-foundation%3AH-02.md), drained lending pools (~$101K) [E5](https://bugbountylibrary.com/r/c4%3A2022-11-size%3AH-02.md), blocked user claims [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-25.md), confirmation of incorrect assertions [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-03.md), and borrowing from frozen pools [E8](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-01.md). Severity is high where funds or core safety guarantees are at stake: the bypass needs no special privilege. E6 is low-severity DoS (later overrides revert), not a fund loss.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-05-arbitrum-foundation%3AH-02.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-25.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-04.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-11-size%3AH-02.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-11-merkl%3AM-03.md
- E7: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.5.md
- E8: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-01.md