Crestal Network · FINDING NOTE
Deployment requests had no recovery path
Reported as HarryBarz. View the public report
Credited alongside other researchers in the final Medium finding group, M-5.
1 min read
Page link
Summary
A paid agent deployment could stall when its assigned worker stopped responding. The workflow gave the owner no reliable way to recover the request and get the work completed.
Root cause
The workflow had a path for assigning work and recording completion, but lacked a reliable recovery route when that work never finished. Request ownership could outlive the worker's willingness or ability to deliver.
Attack scenario
A malicious or unresponsive participant could leave a deployment dependent on work that never arrived. The reported problem was the owner's inability to recover from that failure and continue with another available worker.
Impact
Affected users could lose access to the deployment service they had paid for, while legitimate workers could not complete the abandoned job. The issue disrupted both agent creation and the surrounding service workflow.
Fix recommendation
Provide controlled cancellation, expiry, and reassignment for unfinished work. Sherlock links the remediation to Crestal pull request 19, a merged change adding deployment-status recovery.