# Attacker can DOS OptimisticListing with very low cost

OptimisticListingSeaport only checks new proposal price is lower, so an attacker proposes with 1 wei collateral to block all normal listings, cheaply griefing the protocol.

- Payout: Contest reward
- Severity: high
- Program: Tessera
- Credited: gzeon
- Disclosed: 2023-04-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tessera-findings/issues/25
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tessera%3AH-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** OptimisticListingSeaport.sol proposal creation
**Root cause:** The only constraint on a new proposal is that _pricePerToken is lower than the proposed and active listings; _collateral is unconstrained except nonzero, so a 1-wei collateral proposal with price-1 blocks all legitimate proposals.
**Steps:**
1. Call `_propose(eve, vault, 1, pricePerToken - 1, offer)` with `_collateral = 1` and price one unit below current.
2. The check at OptimisticListingSeaport.sol#L112-L116 passes since price is lower.
3. Any subsequent legitimate proposal with higher price reverts with `NotLower()`.
4. Attacker can reject their own proposal to reset state, or leave it to keep the vault hostage.
**How found:** Code review of the proposal validation logic: noticed only price is compared and _collateral is unconstrained (except nonzero via _verifyBalance), then wrote a Foundry test showing a 1-wei collateral proposal does not revert and blocks others.
**Exploitation:** Attacker repeatedly submits minimal-collateral (1 wei) proposals priced one unit below the active listing, making every legitimate higher-priced proposal revert with NotLower, effectively freezing the listing; attacker can self-reject to reset and repeat.
**Insight:** When a listing/auction only validates one dimension (price) and ignores collateral or size, check whether a dust-sized commitment can satisfy the check and grief all competitors; test the minimum nonzero value explicitly.