# notifyLoss can be frontrun by redeem

Frankencoin reserve depositors frontrun notifyLoss by redeeming shares before loss is booked, then re-depositing at reduced share price to profit.

- Payout: Contest reward
- Severity: medium
- Program: Frankencoin
- Credited: 0xWaitress
- Disclosed: 2023-06-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-frankencoin-findings/issues/48
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:race-window vuln:accounting-error vuln:business-logic vuln:share-inflation

**Target:** ERC20 share-based reserve vault / MintingHub end flow
**Root cause:** notifyLoss transfers ZCHF out of reserve in one step, instantly lowering equity per share; redeemers who already passed the 90-day cooldown can exit at pre-loss price and re-enter at post-loss price.
**Steps:**
1. Observe a challenge in MintingHub that will end in a loss for the reserve.
2. Bundle `redeem` (exit shares at pre-loss price) + `MintingHub::end` (triggers notifyLoss) + `deposit` (re-enter at reduced share price) in one transaction/block.
3. Profit from the equity-per-share delta at the expense of remaining depositors.
**How found:** Reasoned about the atomicity of notifyLoss reducing reserve equity in one step combined with the cooldown-gated redeem path, spotting a MEV sandwich around the loss event.
**Exploitation:** Attacker with matured (post-cooldown) shares frontruns the loss-triggering `end` call, redeems at the higher pre-loss share value, lets notifyLoss reduce reserve equity, then re-deposits at the lower share price, capturing the difference.
**Insight:** When a protocol books losses in a single atomic step, check whether cooldown-matured exiters can sandwich the loss-triggering call with redeem+re-deposit; loss events are MEV surfaces even without liquid markets.