# addCredit() DOS Attack

Anyone can call addCredit() with 1 wei to mutate a lien's hash, front-running validateLien() and DoSing auction and repayment flows.

- Payout: Contest reward
- Severity: medium
- Program: Particle Protocol
- Credited: bin2chen
- Disclosed: 2023-08-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-particle-findings/issues/16
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** Solidity lending/auction contract validateLien()/addCredit()
**Root cause:** addCredit() is permissionless and mutates the lien struct, changing liens[lienId]=keccak256(abi.encode(lien)); validateLien() compares against this hash, so any third party can invalidate a pending transaction.
**Steps:**
1. Attacker observes victim tx calling auctionBuyNft()/startLoanAuction()/stopLoanAuction()/repayWithNft() which invokes validateLien().
2. Attacker front-runs with `addCredit(lienId)` sending `msg.value = 1 wei`, modifying the lien.
3. liens[lienId] hash changes; victim's validateLien() check fails and tx reverts.
**How found:** Code reading: noticed addCredit() is callable by anyone for 1 wei and that it changes the lien struct whose keccak hash is checked in validateLien(), making any pending validateLien() tx front-runnable.
**Exploitation:** Front-run victim transactions with a 1-wei addCredit() call to mutate the lien hash, causing validateLien() to revert; repeated to block bidding, auction start/stop, or NFT repayment.
**Escalation:** Judge noted blocking repayWithNft() prevents borrowers from repaying, a more severe DoS; warden noted a 0.01 ETH minimum still allows profitable DoS of auctionBuyNft() to buy near max price.
**Insight:** When a struct's keccak hash is used as an integrity check, any permissionless mutation of that struct becomes a griefing primitive against every function gated by the check.