# An attacker can DoS vault's buyout with as little as 1 wei per 4 days

Anyone can start a vault buyout with 1 wei and zero fractions, blocking all higher legitimate buyout offers for the 4-day period.

- Payout: Contest reward
- Severity: medium
- Program: Fractional
- Credited: 0xA5DF
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/204
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AM-12
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Buyout module of Fractional vault (Solidity contract)
**Root cause:** start() requires no minimum fraction balance or minimum bid, and only one buyout may be active per vault at a time, so a trivial 1-wei buyout locks the state until it expires.
**Steps:**
1. Deploy/initialize a vault with buyout module enabled.
2. As an account holding 0 fractions, call `buyoutModule.start{value:1}(vault)`.
3. Observe buyout is now active for ~4 days.
4. Have a legitimate holder call `buyoutModule.start{value:1 ether}(vault)` before expiry; it reverts with `InvalidState(0,1)`.
**How found:** Reading the buyout state machine: noticed start() lacks a minimum fraction/bid check and that only one buyout can exist per vault, then wrote a Foundry test proving a zero-fraction account can start with 1 wei and block a 1 ETH offer.
**Exploitation:** Attacker with no vault exposure spends 1 wei to open a buyout, occupying the single active-buyout slot; repeated every 4 days it permanently denies the vault any real buyout, or front-runs a specific competing offer.
**Insight:** On auction/offer modules, check whether the 'one active proposal' guard is paired with a minimum stake or bid; a zero-cost state occupation is a cheap griefing DoS even when no funds are stolen.