# Double-entrypoint collateral token allows position owner to withdraw underlying collateral without repaying ZCHF

Position::withdraw lets owner pass a legacy double-entrypoint collateral address to drain full collateral without repaying ZCHF debt.

- Payout: Contest reward
- Severity: high
- Program: Frankencoin
- Credited: giovannidisiena
- Disclosed: 2023-06-09
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-04-frankencoin-findings/issues/886
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** Position::withdraw / collateral token handling in MintingHub positions
**Root cause:** Position::withdraw only routes to withdrawCollateral when the passed token equals the stored collateral address; a legacy alias address of the same underlying token bypasses the debt check while still moving real collateral balance.
**Steps:**
1. Deploy LegacyToken and DoubleEntryPoint where legacy delegates transfer/balanceOf to the new token
2. Open a position with DoubleEntryPoint as collateral and mint ZCHF against it
3. Dust the position with 1 unit of LegacyToken and call `legacy.delegateToNewContract(doubleEntry)`
4. Call `Position(pos).withdraw(address(legacy), alice, initialAmount)`
5. Observe full collateral withdrawn while ZCHF debt remains unpaid
**How found:** Recognized the double-entrypoint token pattern (TUSD/Compound precedent) and reasoned that withdraw's address-equality check against the stored collateral could be bypassed by an alias address sharing the same underlying balance.
**Exploitation:** Position owner mints ZCHF against collateral, then dusts the position with the legacy token alias and calls withdraw with the legacy address; the alias's balanceOf/transfer delegate to the real token, so the full collateral leaves the position without repaying debt, leaving bad debt.
**Insight:** When a contract gates privileged logic on `token == collateral`, consider alias/double-entrypoint tokens (legacy proxies, upgradeable tokens like USDT) whose balanceOf/transfer resolve to the same underlying balance but a different address; dust + delegate switch is enough to bypass.