Submitted by xuwinnie, also found by 0x1771
When creating a dispute game, the output root should be one of the safe l2 blocks. However, attacker can continuously create games for not yet safe l2 blocks. Honest party can no longer propose the root after it becomes safe, since UUID must be unique. As a result, no root can be successfully defended, the anchor state can no longer be updated and the fund on L2 will be frozen.
When creating a dispute game, the output root should be one of the safe l2 blocks. Otherwise, the claim can be attacked.
However, function create needs uuid to be unique.
If an attacker has already made the claim of this block earlier, when the block is still unsafe, the correct claim can no longer be made.
Attacker can avoid losing the bond by making a attack move in the same transaction, needing 0.08 (create) + 0.08 (attack) = 0.16eth once. The fund will be withdrawable after 3.5 (game clock) + 7 (weth delay) = 10.5 days. 
Assume block time is 2s, the capital needed is 0.16  10.5  24  3600  2 = 72576eth  237 million dollars. Assume interest rate is 3%, to freeze l2 fund for one year, the cost would be 237 million  3% = 7.11 million dollars, while the loss would be 13.54 billion (Optimism + Base TVL)  3% = 406.2 million dollars.
Include parentHash in uuid calculation.
Context
ajsutton (Optimism) acknowledged and commented:
obront (judge) decreased severity to Medium and commented:
EV_om (warden) commented:
xuwinnie (warden) commented:
obront (judge) commented:
ajsutton (Optimism) commented:
obront (judge) commented:
For this audit, 21 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by RadiantLabs received the top score from the judge.
The following wardens also submitted reports: oakcobalt, Zubat, bronze_pickaxe, Bauchibred, sivanesh_808, Al-Qa-qa, SeveritySquad, n4nika, arabgodx, ether_sky, Femboys, alexfilippov314, xuwinnie, twcctop, Naresh, Dup1337, Sparrow, Prestige, Walter, and hihen.
