# Incorrect data location specifier can be abused to cause DoS and fund loss

withdrawBounty uses memory instead of storage for the bounty loop variable, so bounties never deactivate, causing repeated transfers, DoS on auction settlement, and bond loss.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: 0xRajeev
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/168
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-22
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Auction.sol withdrawBounty bounty loop
**Root cause:** The loop variable `bounty` is declared with `memory` data location, so setting `bounty.active = false` mutates a copy, not the storage array element; bounties remain active permanently.
**Steps:**
1. Read Auction.sol#L143-L147: `for (...) { Bounty memory bounty = _bounties[i]; if (bounty.active) { ...transfer...; bounty.active = false; } }`
2. Observe `bounty.active = false` writes to the memory copy only
3. Call `withdrawBounty()` once: transfer succeeds, bounty stays active
4. Call `withdrawBounty()` again: transfer reverts due to insufficient bounty tokens in Auction contract
5. Attacker adds a tiny bounty to any Auction to force every subsequent settle/withdraw to revert
**How found:** Manual code review of the withdrawBounty loop, noticing the `memory` data location specifier on the bounty struct and reasoning about Solidity copy-vs-reference semantics.
**Exploitation:** Attacker adds a minimal bounty to a target Auction contract; because the bounty can never be deactivated, every withdrawBounty/settle attempt reverts on the transfer, blocking reindexing and causing the auctionBonder to lose their bondAmount. Judge noted adding the same bounty multiple times could drain the contract if denominated in the underlying token.
**Escalation:** Repeated bounty additions can drain contract balance (per judge); DoS blocks settlement causing bond loss for auctionBonder.
**Insight:** In Solidity loops over storage arrays, always check the data location of the loop variable: `memory` silently copies structs, so any state mutation inside the loop (flags, counters, balances) is lost. Grep for `memory` struct locals in loops that write fields.