# Transfer position ownership to addr(0) to DoS end() challenge

Position owner transfers ownership to address(0), making MintingHub.end() revert on refund transfer, DoSing challenge settlement and locking bidder funds and challenger collateral.

- Payout: Contest reward
- Severity: high
- Program: Frankencoin
- Credited: \_\_141345\_\_
- Disclosed: 2023-06-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-frankencoin-findings/issues/670
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-04
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** MintingHub/Position challenge settlement (Solidity contracts)
**Root cause:** Position ownership can be transferred to address(0); when end() computes an excess refund it calls zchf.transfer(owner,...) which reverts because ERC20._transfer requires recipient != address(0).
**Steps:**
1. Owner mints 1000 zchf against collateral, minimumCollateral 600.
2. Challenge launched; highest bid 1060 zchf, reward 50.
3. Owner transfers position ownership to address(0).
4. Bidder calls `end(challengeNumber, false)`; notifyChallengeSucceeded returns owner=address(0), effectiveBid=1060, repayment=1000, fundsNeeded=1050.
5. Line 268 `zchf.transfer(owner, effectiveBid - fundsNeeded)` reverts on `require(recipient != address(0))`, so end() always reverts.
**How found:** Reading end() flow: noticed excess-refund branch transfers to owner, and that owner is attacker-controllable via ownership transfer; combined with ERC20 zero-address transfer guard to force revert.
**Exploitation:** Owner facing unavoidable collateral loss transfers position ownership to address(0) before settlement; every end() call reverts, so bidder cannot reclaim/complete and challenger collateral return also fails, locking funds.
**Insight:** When a settlement function pays a refund to a stored owner address, check whether that owner field is mutable to a value that makes the payout revert (address(0), blacklisted token holder, contract rejecting ETH) — a griefing DoS on the whole settlement path.