# A malicious market owner/protocol owner can front-run calls to lenderAcceptBid and change the marketplace fee to steal lender funds

Market/protocol owner front-runs lenderAcceptBid by raising marketplace fee to 100%, siphoning the lender's principal into fees.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: 0xGoodess
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/497
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** TellerV2.lenderAcceptBid / MarketRegistry.setMarketFeePercent / ProtocolFee.setProtocolFee
**Root cause:** lenderAcceptBid reads the marketplace/protocol fee at execution time rather than a lender-committed value, and fee setters have no timelock, so an owner can change fees between submission and execution.
**Steps:**
1. Lender submits `lenderAcceptBid(_bidId)` to mempool.
2. Market owner front-runs with `MarketRegistry.setMarketFeePercent(_marketId, 10000)` (or protocol owner calls `ProtocolFee.setProtocolFee`).
3. lenderAcceptBid computes `amountToMarketplace = principal.percent(getMarketplaceFee(marketplaceId))` at 100%.
4. `amountToBorrower = principal - amountToProtocol - amountToMarketplace` collapses to ~0.
5. Fees transferred via safeTransferFrom to owner() and getMarketFeeRecipient(), draining lender principal.
**How found:** Code review of lenderAcceptBid fee computation combined with README's explicit warning that market owners must not be able to race-condition lenders by changing settings while bids are accepted.
**Exploitation:** Owner observes pending lenderAcceptBid, front-runs fee update to 100%, lender's tx executes paying nearly all principal as fees to the owner-controlled recipient.
**Insight:** When a contract reads mutable config (fees, rates, recipients) at execution time, check whether the counterparty can mutate it in the same block; the README's own threat model often names the exact race to test.