# Bid submission vulnerable to market parameters changes

Teller's _submitBid reads payment cycle, default duration, expiration and payment type from marketRegistry, letting a market owner change them mid-mempool to force instant default and liquidate borrower collateral.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: BAHOZ
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/205
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:liquidation vuln:race-condition

**Target:** TellerV2 _submitBid / MarketRegistry market settings
**Root cause:** _submitBid pulls paymentCycle, paymentCycleType, paymentDefaultDuration, bidExpirationTime and paymentType from marketRegistry at execution time instead of accepting them as bidder-signed inputs, so market-owner changes between submission and inclusion silently alter the bid terms.
**Steps:**
1. Borrower submits `_submitBid` tx with expected market parameters in mempool
2. Market owner calls MarketRegistry setters to set `bidDefaultDuration` and `paymentCycle` to 0 (or otherwise change paymentType/paymentCycle/expiration)
3. Bid tx lands and reads the new values from `marketRegistry.getPaymentCycle/getPaymentDefaultDuration/getBidExpirationTime/getPaymentType`
4. Bid is accepted; with default duration 0 the loan is immediately defaulted and liquidatable
5. Lender/market owner liquidates and takes the borrower's collateral
**How found:** Auditors read the audit scope note warning about market-owner race conditions on bids, then traced _submitBid and observed all bid terms are fetched live from marketRegistry (owner-controlled) rather than passed in by the bidder.
**Exploitation:** Market owner front-runs the borrower's submitBid transaction by mutating MarketRegistry parameters (notably default duration and payment cycle to 0), then accepts the bid and liquidates immediately to seize collateral; lesser variants just commit the borrower to unexpected APR/cycle/expiration terms.
**Escalation:** Parameter change escalates a mild terms mismatch into full collateral theft via immediate default and liquidation.
**Insight:** When a contract reads configuration from an owner-mutable registry at execution time, treat every such read as a frontrunnable input; check whether the user signed/committed to those values, especially parameters that gate liquidation eligibility (default duration, payment cycle).