# Worker-Induced Denial-of-Service in Deployment Requests Due to Lack of a Cancellation Mechanism Medium · Sherlock · AI agent · 11th March 2025 Finding M-5 of the Crestal Network competition. - Protocol: https://audits.sherlock.xyz/contests/755 - Codebase: https://github.com/0xsimao/2025-03-crestal-network/tree/27a3c28155702b3a68f29347efedffb048010e33 - Source: https://github.com/sherlock-audit/2025-03-crestal-network-judging/issues/509 --- The BlueprintCore contract enforces a single deployment request per project by using a check in the [deploymentRequest](https://github.com/sherlock-audit/2025-03-crestal-network/blob/main/crestal-omni-contracts/src/BlueprintCore.sol#L283-L324) function: ```solidity require(projects[projectId].requestDeploymentID == 0, "deployment requestID already exists"); ``` Once a worker picks up the deployment request via the `submitDeploymentRequest` function, the contract sets the request status to `Pickup` and assigns the worker's address: ```solidity require(requestDeploymentStatus[requestID].status != Status.Pickup, "requestID already picked by another worker"); requestDeploymentStatus[requestID].status = Status.Pickup; requestDeploymentStatus[requestID].deployWorkerAddr = msg.sender; ``` There is no mechanism to cancel or reset the request if the assigned worker fails to submit the deployment proof through `submitProofOfDeployment`, leaving the request in an indefinite `Pickup` state. Consequently, the project's deployment process becomes permanently stalled, as further deployment requests cannot be initiated because the project's `requestDeploymentID` remains set. **Primary Root Cause:** The root cause is the contract's design, which permits only one active deployment request per project and lacks a timeout or cancellation function to reset a stalled request when the assigned worker does not complete the process. **Impact:** The project owner cannot progress the deployment, effectively halting the project lifecycle. Funds or NFT-based agent creation fees become unusable as the deployment never completes. **Mitigation:** Implement a timeout mechanism that allows the deployment owner to cancel and reset a stalled deployment request if no proof is submitted within a defined period (e.g., 7 days).