# settleAuction may be impossible if locked at a wrong time.

Auction bonder locking tokens late in an auction causes settleAuction's ibRatio subtraction to underflow, permanently bricking settlement.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: jonah1005
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/41
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-08
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** Auction.sol settleAuction / bondForRebalance
**Root cause:** newRatio = auctionMultiplier*ibRatio - (bondTimestamp-auctionStart)*BASE/auctionDecrement is unchecked; if the bonder locks late enough, b exceeds a and the subtraction underflows, reverting settleAuction forever.
**Steps:**
1. publishNewIndex to start an auction
2. mine ~4 days of blocks so auctionStart is far in the past
3. mine ~20000 more blocks
4. approve all basket tokens to Auction and call `bondForRebalance()`
5. call `settleAuction([],[],[],[],[])` — reverts with panic 0x11 (underflow) in `a - b`
**How found:** Code-reading of the settleAuction arithmetic: noticed a and b are not guaranteed a > b, then wrote a web3.py PoC mining blocks to push bondTimestamp far enough that the subtraction underflows.
**Exploitation:** An auctionBonder locks tokens via bondForRebalance after enough time has elapsed that (bondTimestamp-auctionStart)*BASE/auctionDecrement exceeds auctionMultiplier*ibRatio; settleAuction then always reverts, leaving the auction unsettled and the bonder's tokens stuck until manual intervention.
**Insight:** In auction/settlement math, check whether time-derived subtrahends can exceed the multiplicand; any unchecked `a - b` where b grows with elapsed time is a griefing/DoS vector — test by mining to extreme timestamps.