# Calling generateFLNQuote twice in every block prevents any migration

Public generateFLNQuote lets anyone push two same-block quotes, making _ensurePriceStability revert and blocking Limbo migrations.

- Payout: Audit contest
- Severity: medium
- Program: Behodler
- Found by: camden
- Disclosed: 2022-03-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-behodler-findings/issues/102
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-behodler%3AM-07
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** UniswapHelper.sol / Limbo.sol Solidity contracts
**Root cause:** generateFLNQuote is public and stores quotes with blockProduced=block.number; two calls in one block make the quote-interval subtraction zero, failing the minQuoteWaitDuration require in _ensurePriceStability.
**Steps:**
1. Call `generateFLNQuote()` twice within the same block, so localFlanQuotes[0].blockProduced == localFlanQuotes[1].blockProduced.
2. Any call to `_ensurePriceStability` then evaluates `localFlanQuotes[0].blockProduced - localFlanQuotes[1].blockProduced > VARS.minQuoteWaitDuration` as `0 > minQuoteWaitDuration`, which reverts.
3. The ensurePriceStability modifier on `stabilizeFlan` reverts, and `migrate` in Limbo.sol (which calls stabilizeFlan) reverts.
4. Repeat every `minQuoteWaitDuration - 1` blocks to perpetually block migrations.
**How found:** Code reading: noticed generateFLNQuote is public and writes blockProduced=block.number, then traced the quote-interval require in _ensurePriceStability up through stabilizeFlan to Limbo.migrate.
**Exploitation:** Attacker submits two generateFLNQuote transactions per block (or every minQuoteWaitDuration-1 blocks) to keep the two latest quotes in the same block, causing stabilizeFlan and thus Limbo.migrate to revert for all users; cost is only gas.
**Insight:** When a public function writes a timestamp/block number into a shared slot consumed by a require comparing two entries, check whether an attacker can make both entries identical in one block to force the difference to zero and revert the dependent path.