# Auction bonder can steal user funds if bond block is high enough

Uncapped auction ratio decay lets a bonder wait until newRatio nears zero, then settle and drain nearly all basket tokens.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: kenzo
- Disclosed: 2022-01-26
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-10-defiprotocol-findings/issues/51
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-defiprotocol%3AM-08
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Auction.sol settleAuction bonding/settlement logic
**Root cause:** newRatio = auctionMultiplier*ibRatio - (bondBlock-auctionStart)*BASE/auctionDecrement is unbounded below; as bondBlock grows newRatio can fall below ibRatio or to ~0, and the balance check uses this same ratio to size withdrawals.
**Steps:**
1. Start auction; note ibRatio ~1e18 and auctionMultiplier=2.
2. Wait until bondBlock-auctionStart large enough that newRatio = 2*ibRatio - (bondBlock-auctionStart)*BASE/auctionDecrement approaches 0 (under 3.5 days for ibRatio ~1e18).
3. Call bond() then settleAuction(); tokensNeeded = totalSupply*pendingWeights[i]*newRatio/BASE/BASE ~= 0 passes the require.
4. Withdraw nearly all basket tokens via outputTokens/outputWeights, leaving scraps.
**How found:** Code review of settleAuction's ratio math; observed newRatio is uncapped and decreases with bondBlock, then reasoned it can drop below ibRatio and to ~0, making the balance require trivially satisfiable.
**Exploitation:** Attacker bonds late in an unsettled auction when newRatio is near zero, settles, and redeems basket holdings at near-zero required ratio, extracting user funds.
**Insight:** When a discount/decay formula sizes both a solvency check and the withdrawal amount, check whether the decay term is bounded below; an unbounded subtraction can drive the required collateral to zero.