#  Someone can create non-liquidatable auction if the collateral asset fails on transferring to address(0)

Auction starter can set auctioneer to address(0); the auctioneer reward transfer reverts on such tokens, making the auction permanently non-liquidatable and forcing bad debt.

- Payout: Contest reward
- Severity: high
- Program: Yield
- Credited: antonttc
- Disclosed: 2022-10-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-07-yield-findings/issues/116
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-yield%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** Witch.sol auction/liquidate flow (collateral Join module)
**Root cause:** auction() does not validate that `to` (auctioneer) is non-zero; liquidate() then calls ilkJoin.exit(auction_.auctioneer, auctioneerCut) which reverts on tokens that reject transfers to address(0).
**Steps:**
1. Open a vault and become underwater with insufficient collateral to top up.
2. Call `auction(vaultId, address(0))` on your own vault to start the auction with auctioneer = address(0).
3. Any liquidator calling `liquidate` hits `ilkJoin.exit(address(0), auctioneerCut)` which reverts (OZ-style transfer-to-zero rejection), so the auction can never be liquidated.
**How found:** Code review of auction() input validation and the liquidate() payout path to the auctioneer via the Join module; noticed missing zero-address check combined with OZ transfer-to-zero revert behavior.
**Exploitation:** Attacker monitors their own vault; when underwater, front-runs liquidators by starting an auction with auctioneer=address(0), permanently blocking liquidation and leaving the protocol with bad debt.
**Escalation:** Repeated across vaults leads to systematic protocol debt.
**Insight:** When a reward/recipient address is user-supplied and later passed to a token transfer, a zero-address (or otherwise reverting recipient) can brick the whole liquidation path on tokens that reject such transfers—check every downstream transfer recipient, not just the primary one.