# Caller-supplied field trusted as state

User input written to storage or used as seed without binding to canonical on-chain value

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-08-21. Updated 2026-10-23._

## How it works
A function accepts a value from the caller (a timestamp, type, hash, or seed) and either stores it or uses it to derive something the rest of the system trusts. The code assumes that value is canonical, but nothing binds it to the real on-chain state. The attacker picks the value that benefits them, and downstream logic treats it as authoritative.

## Where it shows up
- Functions that copy a caller-supplied struct into storage without overwriting trusted fields (timestamps, owners, flags).
- Settlement or mint logic that derives an identifier from a caller-supplied hash instead of from curried/immutable config.
- NFT minting that takes a seed, type, or DNA from calldata and feeds it to deterministic attribute generation.
- Any field read later by a gate (e.g. a shutdown check) that was never normalized on write.

## How to review
For every caller-supplied field that reaches storage or a derivation, ask: is this value bound to a canonical source (block.timestamp, immutable/curried config, a signature over the token)? The invariant: trusted state must be derived from trusted inputs, never echoed from calldata. Trace each stored field to every downstream reader and confirm the writer normalizes it. If a fix internalizes one parameter, check whether trust merely moved to another solution field [E1](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.2.md).

## Variants seen
- Settlement derives a coin id from a solution-supplied tail hash rather than the curried statutes, redirecting minted tokens [E1](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.2.md).
- relist() stores the caller's listing struct, leaving `created` attacker-set to block shutdown [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-4.md).
- redeemMintPass accepts arbitrary fighterTypes and dna, minting rare types and copying DNA from prior txs [E3](https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-03.md).

## Why fixes fail
E1's remediation commits only refactored code, shifting trust from one solution field to another without deriving the canonical value from curried state [E1](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.2.md).

## Impact and severity
Token theft and redirection of auction rewards [E1](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.2.md); permanent denial of collection shutdown [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-4.md); unauthorized minting of rare NFTs [E3](https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-03.md). Severity is high where the field gates value transfer or liveness. Worse when the field is read by a gate far from the write, hiding the missing normalization.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.2.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-4.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-03.md