# Try-catch block at Auction._createAuction() will only catch string errors

Auction._createAuction wraps token.mint() in try/catch Error(string), which misses custom-error and arithmetic reverts, so a failed mint bricks the auction instead of pausing it.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: 0xA5DF
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/240
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-12
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Auction.sol _createAuction / token.mint()
**Root cause:** catch Error(string memory) only matches require-style string reverts; custom errors and arithmetic panics bypass it, so the _pause() fallback never runs.
**Steps:**
1. Read Auction.sol#L234: token.mint() wrapped in try/catch Error(string memory) { _pause(); }
2. Note mint() can revert with custom errors or arithmetic panics, not string reverts
3. Reproduce with Foundry: contract reverting `error MyErr()` called inside `try ... catch Error(string memory)` — test fails to catch
4. Observe auction settlement reverts and contract is never paused, requiring owner intervention
**How found:** Code review of the try-catch clause; recognized Solidity semantics that catch Error(string) only handles string reverts, then wrote a minimal Foundry test to confirm custom errors escape the catch.
**Insight:** In Solidity, `catch Error(string memory)` only handles require-string reverts; custom errors and panics need bare `catch` or `catch (bytes memory)` — audit every try/catch for this mismatch since it silently disables fallback logic like pausing.