# StabilizerNode Will Mint An Incentive For Triggering An Auction Even If An Auction Exists Already

StabilizerNode rewards callers for triggering an auction even when an inactive-but-existing auction causes triggerAuction to no-op, letting attackers mint free Malt incentive.

- Payout: Audit contest
- Severity: medium
- Program: Malt Finance
- Found by: leastwood
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-malt-findings/issues/191
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-21
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StabilizerNode / Auction contracts (Solidity)
**Root cause:** _shouldAdjustSupply checks auctionActive but not auctionExists, so an inactive-but-existing auction passes the check while triggerAuction returns early; the caller incentive is still minted.
**Steps:**
1. Call `stabilize()` on StabilizerNode when SwingTrader lacks capital to restore Malt price.
2. Ensure an auction exists but is inactive (auctionExists true, auctionActive false).
3. `_shouldAdjustSupply` passes the active check, `triggerAuction` returns early without starting an auction.
4. Caller still receives the minted incentive reward; repeat to spam-mint Malt.
**How found:** Warden noticed inconsistent use of auctionActive vs auctionExists across StabilizerNode and Auction, spotting the edge case where an inactive existing auction satisfies the check but triggerAuction no-ops.
**Exploitation:** Attacker repeatedly calls stabilize() in the inactive-but-existing auction state; each call mints the caller incentive despite no auction being triggered, extracting free Malt.
**Insight:** When two related state predicates (exists vs active) are used interchangeably across contracts, look for states satisfying one but not the other to bypass guards while still collecting side-effect rewards.