# Bonding mechanism allows malicious user to DOS auctions

Single-bonder auction design lets an attacker bond first on every new index, freezing settlement for 24h until bond burn, repeatedly DoSing rebalancing.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: kenzo
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/66
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-05
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:business-logic vuln:dos

**Target:** Auction/Basket bonding mechanism (Solidity contracts)
**Root cause:** Only one address may bond an auction and only the bonder can settle; bond cannot be burned for 24h, so the first bonder monopolizes and stalls settlement.
**Steps:**
1. Attacker watches mempool for `publishAllIndex` call / `PublishedNewIndex` event.
2. On auction start, attacker front-runs by calling bond, becoming sole bonder.
3. Attacker never calls `settleAuction`; publisher cannot burn bond until 24h (`bondBurn`).
4. After 24h bond burns and new index deleted; attacker repeats on next auction.
**How found:** Reading Auction.sol/Basket.sol: noticed settleAuction restricted to sole bonder and bondBurn has 24h delay, combined with mempool observability of publishAllIndex.
**Exploitation:** Attacker pays bond cost to lock each auction, holding the basket hostage and postponing/preventing new index implementation; only mitigation is front-running the attacker.
**Insight:** When a state-changing action is gated to a single first-come actor with a time-locked exit, check whether a griefer can cheaply seize that role from the mempool and block the protocol's liveness.