# Change in auctionMultiplier/auctionDecrement change profitability of auctions and factory can steal all tokens from a basket abusing it

Factory owner can set auctionMultiplier to 0 and auctionDecrement to max, making newRatio 0 so settleAuction withdraws all basket tokens for free.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: 0x0x0x
- Disclosed: 2022-05-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-defiprotocol-findings/issues/145
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-defiprotocol%3AM-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** Auction/factory rebalancing mechanism (Solidity contracts)
**Root cause:** Auction profitability and settleAuction constraints read live factory-controlled auctionMultiplier/auctionDecrement instead of values snapshotted at startAuction, so governance can retroactively alter bonded auctions.
**Steps:**
1. Factory owner calls `bondForRebalance` to bond an auction.
2. Factory owner sets `auctionMultiplier = 0` and `auctionDecrement` to maximum.
3. Call `settleAuction`; `newRatio = 0` since `a = b = 0`, so `tokensNeeded = 0` and all basket tokens are withdrawable.
**How found:** Code reading of settleAuction's ratio computation revealed it depends on mutable factory parameters rather than values fixed at auction start, enabling retroactive manipulation of bonded auctions.
**Exploitation:** Malicious factory owner bonds an auction, zeroes auctionMultiplier and maxes auctionDecrement, then calls settleAuction to withdraw all tokens from the basket at zero cost.
**Insight:** When auction/settlement math reads governance-mutable parameters live, check whether a party who can bond and also change those params can drive the ratio to zero and extract collateral for free; snapshot params at auction start.