# Users Can Contribute To An Auction Without Directly Committing Collateral Tokens

Auction commitment cap bypassed by sending collateral directly to LiquidityExtension then calling purchaseArbitrageTokens with amount 0, letting users mint unlimited arbitrage tokens and skew average malt price.

- Payout: Audit contest
- Severity: medium
- Program: Malt Finance
- Found by: leastwood
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-malt-findings/issues/188
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-20
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Auction / LiquidityExtension contracts (Solidity)
**Root cause:** purchaseArbitrageTokens computes purchased amount from the contract's collateral balance via purchaseAndBurn rather than the caller's realCommitment, so tokens sent directly to LiquidityExtension count toward the purchase while realCommitment stays zero and the cap is never enforced.
**Steps:**
1. An auction is active.
2. Transfer collateral tokens directly to the LiquidityExtension contract (not via purchaseArbitrageTokens).
3. Call `purchaseArbitrageTokens(0)`; `purchaseAndBurn` returns a positive `purchased` amount from the contract balance.
4. Repeat with amount 0 to keep purchasing arbitrage tokens and influencing the average malt price used in Auction calculations.
**How found:** Code review of Auction.purchaseArbitrageTokens and LiquidityExtension.purchaseAndBurn: noticed purchased amount derives from contract balance rather than caller commitment, so direct transfers bypass realCommitment cap.
**Exploitation:** Attacker pre-funds LiquidityExtension with collateral, then repeatedly calls purchaseArbitrageTokens with amount 0; each call mints arbitrage tokens redeemable for Malt and shifts the average malt price, bypassing the per-auction commitment cap.
**Escalation:** Using amount 0 allows the process to be repeated continuously, effectively purchasing unlimited arbitrage tokens and ending the auction on the attacker's terms.
**Insight:** When a cap is enforced on a user-supplied commitment variable, check whether the value actually used downstream (here purchased amount from contract balance) can be inflated by pre-sending tokens directly to the contract, decoupling accounting from the capped variable.