# Anyone can affect deposits of any user and turn the owner of the token

Public collectRentUser accepted arbitrary future timestamps, letting anyone foreclose any bidder and seize a token via cheap newRental.

- Payout: Audit contest
- Severity: high
- Program: Reality Cards
- Found by: a_dlamo
- Disclosed: 2021-08-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-06-realitycards-findings/issues/119
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-realitycards%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** RCTreasury / Orderbook rental auction contracts
**Root cause:** collectRentUser is public and accepts an arbitrary _timeToCollectTo with no upper bound, so rent can be collected far into the future, marking users as foreclosed.
**Steps:**
1. Call `collectRentUser(user, type(uint256).max)` on RCTreasury for each bidder of a target token, setting `isForeclosed[user] = true`.
2. Call `newRental` with a small price; it iterates prior bids and removes them because they are foreclosed.
3. Attacker becomes owner of the token at minimal cost.
**How found:** Noticed collectRentUser was externally callable and took a caller-supplied timestamp with no bound, then reasoned that max timestamp forces foreclosure state.
**Exploitation:** Attacker forecloses all current bidders of a token by calling the public collectRentUser with max timestamp, then calls newRental cheaply to take ownership, evicting legitimate bidders' deposits.
**Insight:** When a public function takes a timestamp or index parameter, check whether an extreme value (type(uint256).max) can push state into a terminal branch like foreclosure/liquidation that normally requires time passage.