# Later challengers can bid on the previous challenge to extend the expiration time of the previous challenge, so that their own challenge can succeed before the previous challenge and get challenge rewards

A later challenger bids on an earlier challenge to extend its expiry, letting their own challenge end first and steal the challenge reward.

- Payout: Contest reward
- Severity: medium
- Program: Frankencoin
- Credited: cccz
- Disclosed: 2023-06-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-frankencoin-findings/issues/349
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** MintingHub/Position challenge bidding and end()
**Root cause:** Bidding within 30 minutes of challenge end extends challenge.end, breaking the FIFO ordering of concurrent challenges so a later challenge can end before an earlier one.
**Steps:**
1. Alice challenges a 2 WETH position in block 1, challenge expires at block 7201.
2. Bob challenges same position in block 2, expires at block 7202.
3. Bidders bid 4000 ZCHF on each challenge.
4. At block 7200 Bob bids 4200 ZCHF on Alice's challenge, extending its end to block 7351.
5. At block 7201 Alice cannot call end (expiry extended).
6. At block 7202 Bob calls end on his challenge, succeeds, takes reward.
7. At block 7351 Alice calls end but collateral is 0, so she gets no reward; Bob's 4200 ZCHF is returned.
**How found:** Reading the bid-extension logic in MintingHub and reasoning about how extending challenge.end breaks the ordering of concurrent challenges and reward expectations.
**Exploitation:** Attacker waits until near the earlier challenge's expiry, places a minimal 0.5%-higher bid on it to push its end past their own challenge's end, then ends their own challenge first to claim the reward while the earlier challenger is locked out.
**Insight:** When a bid-extension mechanism mutates a shared deadline, check whether concurrent instances of the same object can be reordered to let a later one settle first and capture shared rewards.