# Maximum bid will always be used in Auction

AuctionCrowdfund's bid() is callable by anyone, letting an NFT seller ratchet bids up to maximumBid, forcing the party to overpay.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: csanuragjain
- Disclosed: 2022-11-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/179
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** AuctionCrowdfund.bid() in PartyDAO party-contracts
**Root cause:** bid() is externally callable by anyone (onlyDelegateCall) and only checks the next minimum bid against maximumBid, so an outside party can repeatedly raise the auction price up to the cap without crowdfund member consent.
**Steps:**
1. Start auction for NFT N; P1 initializes AuctionCrowdfund with `maximumBid = 100` and bids 10.
2. NFT price drops; P1 stops bidding at 10.
3. Seller has a friend bid in the external market to become highest bidder.
4. Seller calls `bid()` on AuctionCrowdfund via proxy; since contract is not highest bidder, it bids `market.getMinimumBid()` (<= maximumBid) and sets `lastBid`.
5. Repeat friend-bid + `bid()` until `lastBid` reaches maximumBid 100.
6. Auction settles at 100 instead of 10; seller receives 100.
**How found:** Code reading of bid(): noticed it lacks access control and only compares the next minimum bid to maximumBid, so any external caller can drive the bid upward.
**Exploitation:** Attacker (NFT seller) alternates an accomplice's market bid with direct calls to the crowdfund's permissionless bid(), each time forcing the contract to outbid at the minimum increment until the maximumBid cap is reached, extracting the full cap from party funds.
**Insight:** When a cap variable (maximumBid) is enforced only per-call against the next increment rather than against total committed intent, check who can trigger each increment—permissionless bid/raise functions let outsiders ratchet spend to the cap.