# Publisher can lock all user funds in the Basket in order to force a user to have their bond burned

Basket publisher sets minIbRatio to max, blocking all auction bids and locking user funds; users must burn 0.25% bond to unlock.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: TomFrenchBlockchain
- Disclosed: 2022-05-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-defiprotocol-findings/issues/53
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-defiprotocol%3AM-02
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity vuln:access-control vuln:business-logic

**Target:** Basket.sol auction mechanism
**Root cause:** Publisher can set minIbRatio to type(uint256).max in publishNewIndex, making any auction bid fail and locking the basket in auction state indefinitely.
**Steps:**
1. Publisher calls `Basket.publishNewIndex()` with `minIbRatio = type(uint256).max` and waits 1 day timelock.
2. Auction starts; `Auction.settleAuction()` always reverts because no bid can satisfy minIbRatio.
3. Users cannot enter or exit basket during auction; to unlock, a user must call `Auction.bondForRebalance()` and after 1 day `Auction.bondBurn()`, burning 0.25% of basket token supply.
**How found:** Code review of Basket.publishNewIndex and Auction.settleAuction logic, noticing minIbRatio can be set to max to block all bids.
**Exploitation:** Malicious publisher proposes new index with minIbRatio max, starting auction that cannot settle. Users are forced to burn 0.25% of supply via bondBurn to reset auction and withdraw, losing funds. Publisher can repeat after 24h.
**Insight:** In auction/timelock designs, check if privileged parameters (like minIbRatio) can be set to extreme values that make settlement impossible, forcing users into costly exit paths.