# Basket.sol#auctionBurn() A failed auction will freeze part of the funds

auctionBurn() burns the auction bond without updating ibRatio, so the proportional underlying tokens become permanently frozen in the Basket contract.

- Payout: Audit contest
- Severity: high
- Program: Kuiper
- Found by: WatchPug
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/134
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** Basket.sol auctionBurn() accounting logic
**Root cause:** auctionBurn() calls _burn() reducing totalSupply but never recomputes ibRatio, so the ratio no longer reflects the remaining supply and the burned bond's share of underlying tokens is stranded.
**Steps:**
1. Configure basket.ibRatio=1e18, bondPercentDiv=400, totalSupply=400, tokens=[BTC,ETH], weights=[1,1]
2. Create an auction and bond with 1 BASKET token
3. Wait 24h and call `auctionBurn()`
4. Observe ibRatio still 1e18 while totalSupply=399; burning 1 token returns only 1 BTC + 1 ETH, leaving 1 BTC + 1 ETH frozen
**How found:** Code reading of auctionBurn() noting _burn() mutates totalSupply but ibRatio is left untouched, then constructing a numeric PoC to show the stranded underlying balance.
**Exploitation:** A failed auction's bond is burned via auctionBurn(); because ibRatio is not scaled up, the remaining holders' redeemable share is computed against a stale ratio, permanently stranding the underlying tokens corresponding to the burned bond in the contract.
**Insight:** In basket/index protocols, any path that changes totalSupply must also rescale the index ratio; audit every _burn/_mint site for a matching ratio update, especially failure/cleanup paths like failed-auction bond burns.