# Bonding mechanism allows malicious user to DOS auctions

Single-slot bond in Kuiper auction lets an attacker bond first and lock settlement for 24h, repeatedly DOSing index rebalancing.

- Payout: Audit contest
- Severity: high
- Program: Kuiper
- Found by: kenzo
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-defiprotocol-findings/issues/48
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-defiprotocol%3AH-01
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos

**Target:** Basket/Auction smart contracts (publishAllIndex, settleAuction, bondBurn)
**Root cause:** Only one user may bond an auction and only the bonder can settle, while bondBurn is locked for 24h; a griefer bonding first blocks all other settlers.
**Steps:**
1. Monitor mempool/PublishedNewIndex event for `publishAllIndex`
2. Immediately call bond on the new auction before any legitimate settler
3. Legitimate settler cannot settle (`settleAuction` restricted to bonder) and cannot burn bond for 24h (`bondBurn` time-locked)
4. After 24h bond is burned and index deleted; repeat on next auction
**How found:** Manual code review of bond/settle/burn flow noting single-bonder restriction and 24h burn delay, combined with mempool front-running feasibility.
**Exploitation:** Attacker front-runs auction start by bonding, holding the basket hostage for 24h per cycle; cost is only the burned bond, which may be less than the griefing benefit.
**Escalation:** Repeatable each auction cycle to indefinitely postpone or prevent new index implementation.
**Insight:** When a settlement/claim role is exclusive and its release is time-locked, check whether an attacker can cheaply occupy that role first and block all legitimate actors; griefing cost vs. victim lockup duration is the key ratio.