# Anyone can extend withdraw wait period by depositing zero collateral

MochiVault.deposit accepts amount=0 from anyone, resetting lastDeposit and indefinitely extending the owner's withdraw wait period.

- Payout: Audit contest
- Severity: high
- Program: Mochi
- Found by: harleythedog
- Disclosed: 2021-11-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-mochi-findings/issues/69
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-mochi%3AH-08
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** MochiVault.sol deposit function
**Root cause:** deposit() lacks a require(amount > 0) check and allows any caller to deposit into any position, so a zero-amount call overwrites lastDeposit[_id] and restarts the withdrawal delay.
**Steps:**
1. Identify MochiVault.deposit(_id, amount) callable by anyone for any position.
2. Call `deposit(_id, 0)` on a victim's position id.
3. Observe lastDeposit[_id] reset to current block timestamp.
4. Repeat each block to keep the withdraw wait period permanently unexpired.
**How found:** Code review of MochiVault.deposit noting amount=0 is not disallowed and that it unconditionally overwrites lastDeposit[_id].
**Exploitation:** Attacker repeatedly calls deposit with amount=0 on all position ids, cheaply resetting each lastDeposit timestamp and locking every owner out of withdrawing collateral indefinitely.
**Escalation:** Griefing scales to all positions since deposit is permissionless, denying withdrawal functionality protocol-wide for minimal gas.
**Insight:** When a timestamp gate is written on every deposit, check whether a zero-value or permissionless deposit can reset it; griefing via state-timestamp overwrite is a recurring pattern in vault/withdrawal-delay designs.