# Attacker can delay proposal rejection

Frontrunning rejectProposal by reducing collateral by 1 unit makes the rejection revert, letting an attacker defend an underpriced listing until the proposal period expires.

- Payout: Contest reward
- Severity: medium
- Program: Tessera
- Credited: gzeon
- Disclosed: 2023-04-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tessera-findings/issues/24
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tessera%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:race-condition

**Target:** OptimisticListingSeaport.rejectProposal (Seaport module, Solidity)
**Root cause:** rejectProposal reverts with InsufficientCollateral when proposedListing.collateral < _amount instead of clamping _amount to the remaining collateral, so any partial reduction makes the full rejection call fail.
**Steps:**
1. Attacker proposes listing with 10000 collateral at a very low price
2. Bob calls rejectProposal to purchase the 10000 collateral
3. Attacker monitors mempool and frontruns with a call reducing collateral by 1 unit (`proposedListing.collateral -= _amount`)
4. Collateral becomes 9999; Bob's rejectProposal reverts on `if (proposedListing.collateral < _amount) revert InsufficientCollateral()`
5. Repeat until PROPOSAL_PERIOD passes or Bob gives up from gas costs
6. Attacker buys the NFT at the low price
**How found:** Code reading of rejectProposal's strict `<` comparison against _amount, recognizing that a partial collateral reduction by a frontrunner invalidates the whole rejection call.
**Exploitation:** Attacker underprices their own proposal, then frontruns each rejection attempt with a 1-unit collateral reduction so the victim's full-amount rejection always reverts; sustained until the proposal period lapses, then attacker acquires the NFT cheaply. Requires defending the underpriced proposal against all buyers and selling Raes at a loss.
**Insight:** When a cancel/reject path requires an exact or full amount match against mutable state, a griefer can nudge that state by one unit to make the victim's call revert; check whether partial reductions should be clamped rather than reverting.