# When the challenge is successful, the user can send tokens to the position to avoid the position's cooldown period being extended

Successful challenge skips cooldown extension if collateral balance stays above minimum, letting owner re-mint at manipulated price via MEV top-up.

- Payout: Contest reward
- Severity: high
- Program: Frankencoin
- Credited: cccz
- Disclosed: 2023-06-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-frankencoin-findings/issues/691
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Position.sol internalWithdrawCollateral / MintingHub challenge end()
**Root cause:** internalWithdrawCollateral only sets cooldown=expiration when post-transfer collateral balance falls below minimumCollateral; a top-up keeps balance above the threshold so cooldown is never extended after a successful challenge.
**Steps:**
1. Alice clones position with 1 WETH collateral, mints 0 ZCHF, adjusts price to 10e8 (cooldown extended 3 days).
2. Bob launches challenge with 1 WETH; Charlie bids 1800 ZCHF covering all collateral, deterring other challengers.
3. After 3 days challenge expires; Bob calls `end()`.
4. Alice front-runs via MEV, sending 1 WETH to the position so `collateralBalance()` stays >= minimumCollateral.
5. `internalWithdrawCollateral` transfers collateral to Charlie but skips `cooldown = expiration` since balance >= minimum.
6. Alice mints 10e8 ZCHF at the manipulated price with no cooldown and no active challenge.
**How found:** Code reading of internalWithdrawCollateral's conditional cooldown assignment; noticed the balance check can be satisfied by an external top-up, defeating the intended post-challenge cooldown.
**Exploitation:** Owner sets an inflated price, lets a challenge run to expiry, then MEV-front-runs end() with a collateral top-up so the cooldown branch is skipped, immediately re-borrowing against the still-manipulated price.
**Escalation:** Repeated cycles allow minting large ZCHF against overvalued collateral without waiting out cooldown, threatening protocol solvency.
**Insight:** When a security state transition is gated on a balance threshold, check whether an attacker can donate/top-up to keep the balance above the threshold and skip the penalty; look for MEV-front-runnable end/settle functions.