# Deposits can be denied by abusing maxContractBalance

Treasury deposit cap can be filled by a front-running whale deposit, blocking victim deposits and letting attacker manipulate market outcomes.

- Payout: Audit contest
- Severity: medium
- Program: Reality Cards
- Found by: cmichel
- Disclosed: 2021-08-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-06-realitycards-findings/issues/153
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-realitycards%3AM-16
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:business-logic vuln:dos

**Target:** Treasury deposit function (Solidity contract)
**Root cause:** deposit() enforces erc20.balanceOf(address(this)) + _amount <= maxContractBalance, so a large deposit can push the balance to the cap and cause subsequent deposits to revert.
**Steps:**
1. Attacker observes victim's pending deposit transaction.
2. Attacker front-runs with a deposit sized to bring contract balance to maxContractBalance.
3. Victim's deposit reverts on `require((erc20.balanceOf(address(this)) + _amount) <= maxContractBalance, "Limit hit")`.
4. Attacker withdraws funds afterward, restoring balance.
**How found:** Code review of treasury deposit function's balance cap check, reasoning about front-running and same-block flashbundle ordering.
**Exploitation:** Front-run victim deposit with a large deposit to hit the cap, causing victim deposit to revert; attacker then withdraws. Alternatively submit a (attacker deposit, user deposit, attacker withdraw) flashbundle via flashloan to a miner for same-block execution.
**Escalation:** Blocking competitors from depositing prevents them renting cards, causing forfeiture due to low deposit balance and letting attacker steer market outcome.
**Insight:** Balance-cap or supply-cap checks that read live token balance are griefable: any deposit that saturates the cap DoSes others, and flashbundles let even non-whales do it atomically.