# Backstop bid-side frozen by tick-size constraint

Attacker places a SELL backstop at price=tickSize, making any legal BUY backstop cross and revert, freezing the bid side and blocking liquidation backstop.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: 0xPhantom
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#h-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Perps CLOB backstop orderbook (Market.sol/CLOBLib.sol/Book.sol)
**Root cause:** Backstop orders are maker-only (TiF.MOC) and must be tick-size aligned; the lowest legal BUY price equals the attacker's SELL best ask, so post-only crossing check always reverts.
**Steps:**
1. Attacker places a SELL backstop order at price = tickSize, becoming getBestAsk().
2. Any BUY backstop must be tick-aligned, so minimum legal price >= tickSize.
3. That price equals best ask, so CLOBLib post-only check `ds.getBestAsk() <= newOrder.price` reverts with PostOnlyOrderWouldBeFilled.
4. Bid side of backstop book cannot be populated until attacker cancels or fills.
**How found:** Code reading of backstop maker-only restriction combined with tick-size alignment and post-only crossing check; noticed lowest legal bid equals attacker's ask.
**Exploitation:** Single SELL backstop at tickSize price blocks all BUY backstop placement via post-only revert, denying the backstop bid liquidity needed for liquidations.
**Escalation:** Without backstop bids, liquidations cannot rely on the backstop, degrading protocol solvency guarantees.
**Insight:** When post-only orders must be tick-aligned, the minimum legal price can equal an attacker-placed best ask, so a single cheap order at tickSize permanently blocks the opposite side; check tick granularity vs post-only crossing logic.