# Challenges can be frontrun with de-leveraging to cause lossses for challengers

Position owner frontruns a challenge with repay+adjustPrice to zero the price, then backruns with a 1-wei bid to seize the challenger's collateral.

- Payout: Contest reward
- Severity: high
- Program: Frankencoin
- Credited: carrotsmuggler
- Disclosed: 2023-06-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-frankencoin-findings/issues/945
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:chained vuln:business-logic vuln:race-condition

**Target:** Position challenge/auction contract (launchChallenge, adjustPrice, bid)
**Root cause:** launchChallenge has no slippage/price check, so an owner can repay and call adjustPrice to set price to 0 before the challenge lands; the avert check `_bidAmountZCHF * ONE_DEC18 >= price * _collateralAmount` then passes for any bid.
**Steps:**
1. Open an undercollateralized position (e.g. 1 ETH collateral, 1500 ZCHF minted).
2. Attacker contract frontruns challenger's `launchChallenge`: sends 1500 ZCHF, calls `repay()`, then `adjustPrice(0)` in one tx; collateral check passes since minted amount is 0.
3. Challenger's `launchChallenge` executes, depositing collateral for the auction.
4. Attacker backruns with a bid of 1 wei; `_bidAmountZCHF * ONE_DEC18 >= price * _collateralAmount` passes because price==0, triggering avert.
5. Attacker claims the challenger's collateral at the 1-wei bid price.
**How found:** Reasoned that challenges are irreversible once created and the challenger has already posted collateral, so the owner controls the price at challenge time; noted adjustPrice can be called with external collateral to pass checks, and the avert condition scales with price, so price=0 makes any bid pass.
**Exploitation:** Sandwich: frontrun with repay+adjustPrice(0) to zero the position price, let the challenger's launchChallenge deposit collateral, then backrun with a minimal bid that satisfies the avert condition and ends the challenge, capturing the challenger's collateral.
**Insight:** When an auction/challenge price is read at execution time and the counterparty can mutate it beforehand, look for a missing expected-price/slippage parameter; also check whether the bid-acceptance inequality collapses when price is zero.