# Auction settler can steal user funds if bond timestamp is high enough

Uncapped auction bond discount lets newRatio fall below ibRatio, so a settler bonds late and withdraws nearly all basket tokens.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: kenzo
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/45
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-23
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Auction.sol settleAuction bonding logic
**Root cause:** newRatio = auctionMultiplier*ibRatio - (bondTimestamp-auctionStart)*BASE/auctionDecrement is unbounded below; no check that newRatio stays above ibRatio, so tokensNeeded shrinks toward zero.
**Steps:**
1. Start auction; wait until bondTimestamp large enough that newRatio < basket.ibRatio() (or ~0 after ~3.5 days for ibRatio ~1e18)
2. Call bond() then settleAuction() with crafted outputTokens/outputWeights
3. tokensNeeded = totalSupply*pendingWeights[i]*newRatio/BASE/BASE ~= 0 passes balance check
4. Withdraw nearly all basket tokens via outputTokens/outputWeights, leaving scraps
**How found:** Code reading of settleAuction: noticed newRatio decreases linearly with bondTimestamp and is never floored, then reasoned that a large enough timestamp drives tokensNeeded to zero.
**Exploitation:** Attacker waits for an unsettled auction, bonds at a late timestamp so newRatio collapses, settles, and uses the near-zero tokensNeeded to withdraw almost the entire basket balance, stealing user funds.
**Insight:** In auction/discount math, check whether the time-decayed ratio is bounded below; a linear decrement with no floor lets a late settler zero out collateral requirements.