# Basket can be fully drained if the auction is settled within a specific block

Kuiper basket drained by timing bondForRebalance so newRatio computes to 0, zeroing tokensNeeded and letting settleAuction release all tokens.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: Ruhum
- Disclosed: 2022-05-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-12-defiprotocol-findings/issues/74
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-defiprotocol%3AM-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Solidity Basket/Auction settleAuction rebalance logic
**Root cause:** settleAuction computes newRatio = auctionMultiplier*ibRatio - (bondBlock-auctionStart)*BASE/auctionDecrement; attacker controls bondBlock timing so newRatio becomes 0, making tokensNeeded 0 for every pending token.
**Steps:**
1. publishNewIndex twice to start an auction
2. mine blocks until bondBlock - auctionStart == 20000 (with default auctionMultiplier=2, ibRatio=1e18, BASE=1e18, auctionDecrement=10000)
3. call `auction.bondForRebalance()` at that block
4. call `auction.settleAuction([],[],[],[UNI,AAVE],[weights])` — tokensNeeded is 0 so balance check passes and tokens are withdrawn
**How found:** Read settleAuction's balance-check loop, noticed tokensNeeded is a product including newRatio, and reasoned that driving newRatio to 0 via the attacker-controlled bondBlock zeroes the requirement.
**Exploitation:** Attacker waits for the exact block offset so newRatio=0, bonds, then settles the auction specifying arbitrary output tokens/weights; the require(balanceOf(basket) >= tokensNeeded) check passes trivially since tokensNeeded=0, draining basket holdings.
**Insight:** When a solvency check multiplies supply by a ratio derived from block-number arithmetic, look for inputs (block timing, decrement) that can drive the ratio to zero and nullify the check.