# User collateral NFT open auctions would be sold as min price immediately next time user health factor gets below the liquidation threshold, protocol should check health factor and set auctionValidityTime value anytime a valid action happens to user account to invalidate old open auctions

Stale open NFT auctions in ParaSpace let attackers liquidate collateral at minimum auction price the next time a user's health factor dips below threshold.

- Payout: Contest reward
- Severity: medium
- Program: ParaSpace
- Credited: unforgiven
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/323
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** NFT collateral auction / liquidation logic in ParaSpace pool contracts
**Root cause:** Auction validity is determined by comparing auction startTime to a user-set auctionValidityTime that is never refreshed automatically; old auctions remain valid indefinitely and their price multiplier decays to the minimum over time.
**Steps:**
1. User's NFT health factor drops below liquidation threshold.
2. Attacker calls `startAuction()` for all user collateral NFT tokens, opening auctions.
3. User restores health factor (e.g., supplies collateral) but does not call `setAuctionValidityTime()`, so auctions stay open.
4. Time passes; `calculateAuctionPriceMultiplier()` decays price to `_minPriceMultiplier`.
5. User's health factor drops below threshold again; attacker liquidates all NFTs immediately at minimum auction price via `isAuctioned()` returning true.
**How found:** Code review of `calculateAuctionPriceMultiplier` (price decays to min over ticks) combined with `isAuctioned` (validity gated only by manually-set `auctionValidityTime`), inferring stale auctions persist across health-factor recoveries.
**Exploitation:** Attacker pre-opens auctions during any transient unhealthy period, waits for price decay to minimum, then liquidates the victim's NFTs at min price on the next unhealthy event without a fresh auction.
**Insight:** When auction/liquidation validity depends on a user-maintained timestamp, check whether any state transition (health restore, deposit, repay) auto-invalidates it; if not, stale auctions can be replayed at decayed prices.