# Akutar NFT: contract bidder DoS and locked project funds

Akutar NFT refund loop reverts on a malicious contract bidder, blocking honest refunds, and a bad require locks 34M USD of project funds forever.

- Payout: Real-world hack
- Severity: high
- Program: Akutar NFT
- Analysis by: DeFiHackLabs
- Disclosed: 2022-04-23
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-04/AkutarNFT_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220423-akutarnft
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:dos

**Target:** NFT auction smart contract (bid/processRefunds/claimProjectFunds)
**Root cause:** processRefunds pushes ETH to bidders without checking if bidder is a contract, so a reverting fallback aborts the whole refund loop; claimProjectFunds has an incorrect require that can never pass, locking funds.
**Steps:**
1. Attacker contract calls `akutarNft.bid{value: 3.5 ether}(1)` with a fallback that `revert("CAUSE REVERT !!!")`.
2. Honest user bids `akutarNft.bid{value: 3.75 ether}(1)` after the attacker.
3. After auction ends, call `akutarNft.processRefunds()`; the loop hits the attacker contract, reverts, and honest user's refund is never sent.
4. Owner calls `akutarNft.claimProjectFunds()` which reverts due to incorrect require, locking >34M USD.
**How found:** Code review of the refund loop and claim logic: noticing ETH push to arbitrary bidders without contract check, and a require condition that cannot be satisfied.
**Exploitation:** Attacker places a small bid from a contract whose fallback reverts; when processRefunds iterates bidders in order, the revert aborts the entire refund transaction, denying refunds to all later bidders. Separately the flawed require in claimProjectFunds permanently blocks withdrawal of project funds.
**Insight:** When auditing auction/refund contracts, check whether ETH is pushed to bidders in a loop without pull-payment pattern or contract-bidder guard; a single reverting fallback can brick all refunds. Also verify require conditions in fund-claim functions are actually satisfiable.