# bids can be created against markets that doesn't exist

TellerV2.submitBid lacks market-existence check, letting a bid target a future market ID; once accepted, zero defaultDuration/paymentCycle makes the loan unliquidatable and unrepayable, locking collateral.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: immeas
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/323
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** TellerV2 lending contract submitBid / MarketRegistry
**Root cause:** submitBid only checks !isMarketClosed rather than verifying the marketId exists, so bids can reference future market IDs; the resulting bid has bidDefaultDuration and paymentCycle of 0, breaking default/liquidation and repay math.
**Steps:**
1. Call `tellerV2.submitBid(principalToken, 1, amount, 360 days, 0, "", alice)` with a marketId that does not yet exist and 0% APY (nonzero APY reverts on div-by-0).
2. Observe `lenderAcceptBid(bidId)` reverts before the market exists.
3. Owner calls `marketRegistry.createMarket(...)` creating that marketId.
4. Lender calls `lenderAcceptBid(bidId)`; loan is now active.
5. Warp past duration; `isLoanDefaulted` and `isLoanLiquidateable` return false because `bidDefaultDuration[_bidId]==0`.
6. `repayLoanFull(bidId)` reverts on division by `_bid.terms.paymentCycle==0`; collateral is locked forever.
**How found:** Code review of submitBid's market validation: noticed only isMarketClosed is checked, not existence; traced downstream that bidDefaultDuration and paymentCycle stay 0, breaking isLoanDefaulted and repay math.
**Exploitation:** Attacker front-runs a market creation (predictable incrementing marketId) by submitting a 0% APY bid for the soon-to-exist market, luring a lender in a trusted marketplace to accept; the loan can never be liquidated, defaulted, or repaid, locking borrower collateral and trapping lender funds.
**Escalation:** Front-running market creation via mempool/predictable marketId to place the bid before the market exists, then having a lender accept it in a trusted marketplace.
**Insight:** When auditing bid/order submission, check whether the referenced registry entity is validated for existence, not just its closed/active flag; zero-valued derived fields (durations, cycles) from uninitialized references often cause div-by-0 or bypassed liquidation checks.