# Scoop ERC20 tokens from basket contract

settleAuction transfers any caller-specified outputToken from the basket, letting anyone drain unrelated ERC20s (airdrops, bounties) held by the contract.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: gpersoon
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/56
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-19
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Auction.sol settleAuction on basket contract
**Root cause:** settleAuction iterates caller-supplied outputTokens and safeTransferFrom's them from the basket without verifying they are part of basket.tokens().
**Steps:**
1. Deposit/obtain a bond via `bondForRebalance()` so settleAuction is callable
2. Call `settleAuction(..., outputTokens=[unrelatedToken], outputWeights=[balance])`
3. Contract executes `IERC20(outputTokens[i]).safeTransferFrom(address(basket), msg.sender, outputWeights[i])`
4. Attacker receives the unrelated ERC20 held by the basket
**How found:** Code review of settleAuction's transfer loop noticing outputTokens is fully caller-controlled and never checked against basket.tokens().
**Exploitation:** Attacker bonds, then calls settleAuction specifying any ERC20 sitting in the basket (airdrop, mistakenly sent token, or bounty token) as outputToken with weight equal to its balance, receiving it directly to msg.sender.
**Escalation:** Judge noted the same flaw lets an attacker steal bounty tokens posted in unprotected ERC20s without claiming the bounty.
**Insight:** In auction/settlement contracts, any caller-supplied token list used in a transfer loop must be intersected with the contract's registered asset set; stray airdrops and bounty tokens become free loot otherwise.