# Auction.sol#settleAuction() Mishandling bounty state could potentially disrupt settleAuction()

withdrawBounty copies Bounty to memory, so active flag never clears, letting stale bountyIds revert settleAuction and cost the bonder their bond.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: WatchPug
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/136
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-16
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Auction.sol settleAuction/withdrawBounty (Solidity smart contract)
**Root cause:** withdrawBounty loads the Bounty struct into memory instead of storage, so `bounty.active = false` mutates a copy and the on-chain active flag stays true.
**Steps:**
1. Create an auction and add a bounty.
2. Settle the auction with the bounty claimed (withdrawBounty runs, active stays true due to memory copy).
3. Create a new auction and add a new bounty.
4. Call `settleAuction()` passing the bountyIds of both seemingly active bounties; the require(bounty.active) path and stale state cause a revert, blocking settlement.
**How found:** Code review of withdrawBounty: noticed `Bounty memory bounty = _bounties[...]` then `bounty.active = false`, recognizing the memory copy means the state write is lost.
**Exploitation:** Attacker (or any user) references previously-claimed bountyIds that remain active in storage; settleAuction reverts, preventing settlement and causing the bonder to lose the bond.
**Insight:** In Solidity, assigning a struct from a mapping to a `memory` variable copies it; any mutation is discarded. Grep for `memory` struct loads followed by field writes in claim/withdraw loops.