# Third-party action blocks victim operation

Can a permissionless call move or taint state so a victim's legitimate call reverts?

_Area: Smart contract access control and control flow. Seen in 6 disclosed reports; latest 2026-02-05. Updated 2026-10-23._

## How it works
A legitimate operation assumes a precondition holds when it runs: the contract still holds the NFT, the pair's reserves are both non-zero, the address is not flagged. A permissionless function lets an outsider change that precondition cheaply, and the victim's call then reverts. The broken assumption is that state a victim depends on cannot be moved by someone else between the victim's decision and their transaction.

## Where it shows up
- Withdrawal or claim paths that call `safeTransferFrom`/`transfer` on an asset the contract must currently hold.
- Any permissionless function that can move that asset out and be reversed cheaply (open a loan, swap, repay).
- Liquidity or mint paths delegating to a UniswapV2-style router, where `quote()` needs both reserves > 0.
- A `sync()` or donation path that can force one-sided reserves.
- Per-address boolean flags set on any inbound credit and never cleared, gating transfers.
- Transfer validation that keys on a flag rather than on actual amounts.
- Guards keying restrictions on (token, id) rather than on the specific rented units.
- State derived from any single user action (e.g. a "largest tier claimed" marker) that pins a liveness mechanism.

## How to review
For each victim-facing call, list its preconditions and ask who else can break each one. The invariant: no permissionless action by a third party may make a legitimate call revert, or must cost the attacker more than the harm done. Check that asset-holding assumptions are re-checked or made atomic, that reserve preconditions cannot be poisoned by a dust donation, that flags are amount-based or clearable, and that guards track specific units, not just token IDs. Confirm the attacker cannot reverse their action for free.

## Variants seen
- NFT pulled out via a loan opened by anyone, so withdrawal reverts; reversible at zero cost via repay [E4](https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AM-01.md).
- 1-wei donation plus `sync()` makes `addLiquidity` revert on `quote()`, blocking graduation [E5](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-09.md).
- 1-wei bridged credit sets a permanent flag, locking the victim's whole balance [E6](https://bugbountylibrary.com/r/c4%3A2025-02-thorwallet%3AM-01.md).
- Open burn destroys locked tokens before the exit path, so `exitPosition` reverts and weights never reset [E1](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-11.md).
- Guard blocks all transfers of a rented token ID, freezing the borrower's unrented units of that ID [E2](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-01.md).
- One cheap last-tier claim pins the tier open, denying other users' prizes [E3](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-15.md).

## Why fixes fail
Boolean bridged-holder tracking is set on any bridged credit and never cleared, so a single wei permanently taints an address [E6](https://bugbountylibrary.com/r/c4%3A2025-02-thorwallet%3AM-01.md).

## Impact and severity
Blocked withdrawals, stalled graduation, frozen balances and denied prizes; medium severity in the evidence. Worse when the block is permanent [E6](https://bugbountylibrary.com/r/c4%3A2025-02-thorwallet%3AM-01.md) or cheap to repeat, and when no alternative path exists for the victim. Temporary blocks that cost the attacker nothing [E4](https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AM-01.md) are lower tier than permanent locks.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-11.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-15.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AM-01.md
- E5: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-09.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-02-thorwallet%3AM-01.md