# Attacker can force AuctionCrowdfunds to bid their entire contribution up to maxBid

AuctionCrowdfund.bid() only blocks bids when the party is already top bidder, letting an attacker self-outbid to force the party to pay up to maxBid.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: Trust
- Disclosed: 2022-11-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/220
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** AuctionCrowdfund bid() auction contract
**Root cause:** bid() reverts only if the party is the current highest bidder, so an attacker bidding from their own wallet then overbidding via the party forces the party to escalate to maxBid.
**Steps:**
1. Attacker lists NFT valued at X and creates AuctionCrowdfund with maxBid Y=2X
2. Current bid is X - AUCTION_STEP; users contribute 1.5X
3. Users call `bid()` at X
4. Attacker bids externally at 1.5X - AUCTION_STEP
5. Attacker calls `bid()` causing party to bid 1.5X
6. Attacker sells NFT at 1.5X despite no real demand above X
**How found:** Reading bid()'s AlreadyHighestBidderError guard and noticing it only checks the party's address as highest bidder, not bids placed by the attacker externally.
**Exploitation:** Attacker controls both the auction listing and the party's bid trigger, using their own wallet bid to reset the highest-bidder check, then invoking bid() so the party outbids itself up to maxBid, extracting inflated sale price.
**Insight:** When a contract guards against self-outbidding by checking only its own address as top bidder, consider that an external wallet bid resets that check, enabling forced escalation to the cap.