# Function cancelMint can be frontrunned to grief a validator Low/Info · Three Sigma · Stablecoin framework · 8th January, 2024 Finding 3S-M^0-L09 of the M^0 Minter Gateway security review. - Protocol: https://www.m0.org/ - Report: /reports/m-0 - Codebase: https://github.com/0xsimao/ttg/tree/a8127901fa1f24a2e821cf4d9854a1aa6ac8088c - Source: https://cdn.sanity.io/files/qoqld077/production/1cdafafad874aba76e062ad8c216c98338c096db.pdf --- ### Description In the [MinterGateway.cancelMint](https://github.com/MZero-Labs/protocol/blob/3499f50ff3382729f3e59565b19386ba61ef8e36/src/MinterGateway.sol#L327-L335) function, an approved validator cancels a mint proposal by passing the minter address and mintId. The function will revert if the the minter's proposal doesn't correspond to the input id. Each mintId is generated from a nonce, and this is independent from the proposal details. A minter can frontrun any cancelMint call by calling proposeMint with the exact same parameters as their mint proposal that was about to be cancelled. This will revert the validator's transaction, because the specified id will no longer be correct. A minter can keep doing this until they potentially get frozen by the validator. ### Status Acknowledged --- Related findings: - [Wrong transformation in function previewMintDebt(...)](https://0xsimao.com/findings/fuji-finance-transformation-preview-mint-debt): Fuji Finance - [In function mint() and lzReceive(), _safeMint() is recommended over _mint(), which performs additional checks](https://0xsimao.com/findings/metazero-i-mint-recommended-performs-additional): MetaZero Omnichain NFTs