# Challengers and bidders can collude together to restrict the minting of position owner

Challenger and colluding bidder repeatedly launch and avert tiny challenges on a Frankencoin position, each avert calling restrictMinting(1 days) to indefinitely block the owner from minting.

- Payout: Contest reward
- Severity: medium
- Program: Frankencoin
- Credited: peanuts
- Disclosed: 2023-06-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-frankencoin-findings/issues/745
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AM-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Position/challenge auction contract (launchChallenge, tryAvertChallenge)
**Root cause:** tryAvertChallenge calls restrictMinting(1 days) on every successful avert, and launchChallenge imposes no cost or limit on repeated challenges, so a challenger+bidding colluder can chain averts to extend the owner's cooldown indefinitely.
**Steps:**
1. Owner opens position at fair price (e.g. 1000 ZCHF per 1 WETH).
2. Challenger calls `launchChallenge(position, 0.0001 WETH)` with tiny collateral.
3. Colluding bidder calls `tryAvertChallenge(0.0001 WETH, bidAmountZCHF)` with bid >= price*collateral.
4. Avert succeeds, `restrictMinting(1 days)` extends cooldown.
5. Repeat each period; colluder buys collateral from himself at fair price, losing only gas.
**How found:** Code reading of launchChallenge (no challenge count/cost limit) and tryAvertChallenge (unconditional restrictMinting on avert), noticing the challenger risks nothing when the bidder is colluding.
**Exploitation:** Challenger and bidder are same entity or colluders; bidder's over-market bid just moves collateral between themselves, while each avert resets the owner's minting cooldown, denying the owner minting for as long as they keep paying gas.
**Insight:** Look for state-changing penalties (cooldowns, locks) triggered by an action an attacker can self-fund or self-counterparty; if the 'loser' of an auction can be the same party as the winner, the penalty becomes a free griefing primitive.