Frankencoin — Transfer position ownership to address(0) DoSes end()

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen. Standalone Foundry PoC and full write-up: 20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/frozen-funds · vuln/ownership-transfer · vuln/dos-resistance

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen.sol.

Key info#

TL;DR#

1. Owner about to lose a challenge calls transferOwnership(address(0)).
2. Winning bid creates an excess refund path in end().
3. zchf.transfer(owner, excess) reverts because recipient is zero.
4. Bid ZCHF and challenger collateral stay locked in the hub forever.

The vulnerable code#

// MintingHub.end — excess refund
if (effectiveBid > fundsNeeded) {
    // @> VULN: reverts when owner is address(0)
    zchf.transfer(owner, effectiveBid - fundsNeeded);
}

// ERC20._transfer
function _transfer(address sender, address recipient, uint256 amount) internal virtual {
    require(recipient != address(0)); // zero-address guard
    ...
}

Fix: disallow transferOwnership(address(0)); optionally skip/burn excess when owner is zero.

Root cause#

Settlement always tries to refund excess bid to the current position owner. Ownership is transferable to the zero address, and the ZCHF ERC20 forbids transfers to zero — so a malicious (or desperate) owner can brick every end() that would pay them a refund.

Attack walkthrough#

1. Challenge + winning bid escrowed (period 0 so end is immediate).
2. Owner calls transferOwnership(address(0)).
3. Anyone calls end() → excess refund reverts.
4. Bid and challenger collateral remain in the hub; challenge never clears.

Diagrams#

Impact#

• Successful bidder loses the bid fund (locked, unrecoverable via end).
• Challenger loses escrowed collateral and challenge reward.
• Liquidation / challenge settlement for that position is permanently bricked when excess would be refunded.

Taxonomy#

• genome: frozen-funds, ownership-transfer, dos-resistance, reward-accounting
• sector: lending, token
• severity: high
• platform: code4rena

Sources#

• AuditVault finding #20019
• Code4rena report 2023-04-frankencoin
• Reduced from code-423n4/2023-04-frankencoin MintingHub.end + ERC20._transfer + position ownership transfer

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen_exp (evm-hack-registry mirror).
• AuditVault finding: 20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.