# Attacker can front-run Bond buyer and make them buy it for a lower payout than expected

MuteBond's epochStart price decay lets an attacker front-run a buyer's deposit with small purchases, lowering the victim's bond payout by ~32%.

- Payout: Contest reward
- Severity: high
- Program: Mute.io
- Credited: 0xA5DF
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-mute-findings/issues/24
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:race-window vuln:accounting-error vuln:business-logic

**Target:** MuteBond deposit() / bondPrice()
**Root cause:** Each purchase advances epochStart by 5% of elapsed time, lowering bond price (payout per value) for subsequent purchases; deposit() has no min-payout slippage parameter.
**Steps:**
1. Wait until bondPrice reaches max price.
2. Victim submits deposit(depositValue, addr, false) to mempool expecting current price.
3. Attacker front-runs with 20 minimal deposits (minPurchaseValue) to advance epochStart and drop price.
4. Victim's deposit executes at reduced price (~68% of expected, ~32% lower payout).
**How found:** Reading MuteBond logic: noticed epochStart advances 5% of elapsed time per purchase, lowering price for future buyers; hypothesized mempool front-running of a deposit tx.
**Exploitation:** Attacker observes victim deposit in mempool, submits many tiny deposits ahead of it to push epochStart forward and depress bondPrice, causing victim to receive fewer dMute tokens for the same deposit value.
**Insight:** State variables mutated on every purchase that affect price for the next buyer are front-runnable; check any deposit/mint lacking a user-supplied min-out/slippage bound.