# Position owners can deny liquidations

Position owner sets price to type(uint256).max, overflowing tryAvertChallenge so challenges can't be bid on or ended, blocking liquidation and trapping challenger funds.

- Payout: Contest reward
- Severity: high
- Program: Frankencoin
- Credited: JGcarv
- Disclosed: 2023-06-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-frankencoin-findings/issues/481
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-05
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** Position.sol adjustPrice/tryAvertChallenge/end challenge logic
**Root cause:** adjustPrice accepts type(uint256).max without bounds; tryAvertChallenge computes with the price and overflows, reverting, so bids and challenge settlement fail.
**Steps:**
1. Open a position and mint zchf against collateral
2. As position owner call `pos.adjustPrice(type(uint256).max)`
3. Challenger calls `bob.challenge(hub, posAddress, 1001)`
4. Challenger funds and calls `bob.bid(hub, first, 10_000 ether)` — reverts due to overflow in tryAvertChallenge
5. After challenge period, `hub.end(first, false)` also reverts, locking challenger funds
**How found:** Code review of Position price adjustment and challenge flow; noticed no upper bound on price and that challenge math multiplies by price, then wrote a Foundry PoC confirming bid and end both revert.
**Exploitation:** Owner facing de-peg/run sets price to uint256 max; any bid or end call overflows and reverts, so liquidation never completes and collateral stays stuck while owner keeps zchf; challenger loses deposited funds.
**Insight:** When a user-controlled parameter feeds multiplication in a challenge/liquidation path, check for missing upper bounds — an extreme value can DoS settlement and trap challenger capital, not just misprice.