# Owner can steal all Basket funds during auction

Factory owner can set auctionMultiplier/auctionDecrement mid-auction so tokensNeeded≈0, draining Basket underlying tokens without paying pending tokens.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: 0xsanson
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/265
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-11
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Auction.sol / Factory auction parameter setters
**Root cause:** auctionMultiplier and auctionDecrement are owner-mutable at any time and read live during auction to compute newRatio and tokensNeeded, with no timelock or auction-in-progress guard.
**Steps:**
1. Owner starts/participates in an auction on a Basket.
2. Owner calls Factory setters to set auctionMultiplier/auctionDecrement so computed newRatio makes `tokensNeeded` = 0 (or near zero) for the token.
3. Owner takes underlying tokens from the Basket while transferring no/negligible pending tokens.
**How found:** Code review of Auction.sol L89-99: noticed newRatio/tokensNeeded derive from owner-controlled factory params that lack timelock or auction-state checks.
**Exploitation:** Owner joins auction, then front-runs the settlement by changing factory params so tokensNeeded collapses to ~0, then claims underlying Basket tokens for free.
**Insight:** When auction pricing reads live owner-settable parameters, check whether those setters can be called mid-auction to collapse the required payment to zero.