# getAuctionCore function returns wrong values out of order

Missing comma in tuple destructuring of getAuctionCore's 10 return values shifts 'active' into the preAuctionReserveRatio slot, corrupting early-exit logic in AuctionEscapeHatch.

- Payout: Audit contest
- Severity: high
- Program: Malt Finance
- Found by: jayjonah8
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-malt-findings/issues/63
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AuctionEscapeHatch.sol / Auction.sol getAuctionCore
**Root cause:** getAuctionCore returns 10 values; callers destructure with a missing comma placeholder, so the 10th return (active) binds to the 9th variable (preAuctionReserveRatio) and active stays default false.
**Steps:**
1. Read Auction.sol#L527 getAuctionCore return tuple: 10 values with active last.
2. Inspect AuctionEscapeHatch.sol#L100 and #L174 destructuring: only 9 slots, missing a comma before bool active.
3. Observe active receives preAuctionReserveRatio's slot and the real active value is dropped.
4. Call earlyExitReturn()/_calculateMaltRequiredForExit() on an active auction; logic treats it as inactive, mispricing early exit.
5. Fix by adding the extra comma placeholder so active binds to the 10th return.
**How found:** Manual code review comparing the return tuple of getAuctionCore against the destructuring in both callers; noticed the argument count mismatch (9 vs 10) caused by a missing comma.
**Exploitation:** User calls earlyExitReturn or _calculateMaltRequiredForExit on an active auction; the misread 'active' flag causes incorrect MALT-required/exit calculations, letting exits settle at wrong terms and draining user funds.
**Insight:** When a function returns a long positional tuple, diff the return list against every destructuring site and count commas—silent slot shifts are invisible to the compiler and only surface as wrong-value logic bugs.