# Auction.sol#settleAuction() late auction bond could potentially not being able to be settled, cause funds loss to bonder

Late bonding of a Kuiper rebalance auction makes newRatio underflow in settleAuction, reverting settlement and trapping the bonder's funds.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: WatchPug
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/90
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-15
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** Auction.sol settleAuction/bondForRebalance
**Root cause:** newRatio = a - b where b grows with (bondTimestamp - auctionStart); if bonding is late enough relative to auctionMultiplier/auctionDecrement, b > a and the uint256 subtraction underflows, reverting settleAuction.
**Steps:**
1. Configure basket.ibRatio=1e18, auctionDecrement=5760, auctionMultiplier=2
2. Create an auction and leave it unbonded >2 days (>11,520 blocks)
3. Call `bondForRebalance()` — succeeds
4. Call `settleAuction()` — always reverts on `a - b` underflow
**How found:** Code reading of the newRatio formula: noticed b scales with elapsed blocks while a is fixed by multiplier*ibRatio, so a late bond can drive b above a and underflow the subtraction.
**Exploitation:** Bonder submits bondForRebalance near the deadline; block inclusion pushes bondTimestamp past the point where b>a, so settleAuction reverts and the posted bond is stuck/lost.
**Insight:** When a formula subtracts an elapsed-time-scaled term from a fixed term in uint256, check whether the time term can exceed the fixed term at the extreme end of the allowed window — especially when the timestamp is set at block inclusion, not submission.