# Malicious actor can win an auction unfavorably to the protocol by block stuffing

Venus Shortfall auction's 10-block next-bidder window lets a bidder block-stuff BSC cheaply to prevent overbids and win bad debt at the minimum 10% incentive.

- Payout: Contest reward
- Severity: medium
- Program: Venus Protocol
- Credited: DeliChainSec
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-venus-findings/issues/525
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm technique:race-window vuln:business-logic vuln:dos

**Target:** Shortfall auction contract (closeAuction / bid flow)
**Root cause:** Auction closes once block.number > highestBidBlock + nextBidderBlockLimit (10 blocks), so a sole bidder only needs to suppress competing bids for ~11 blocks; on BSC filling blocks with dummy txs is cheap and there is no private mempool to route around it.
**Steps:**
1. Pool accrues bad debt eligible for auction.
2. Attacker frontruns and bids the minimum (bad debt + 10% incentive) via Shortfall bid.
3. Attacker floods BSC blocks with high-gas dummy transactions for 11 blocks to crowd out competing bids.
4. Attacker calls `closeAuction(comptroller)` once `block.number > highestBidBlock + nextBidderBlockLimit` and `highestBidder != address(0)`.
5. Attacker receives the auctioned bad debt plus the 10% incentive.
**How found:** Reading closeAuction's require that only checks block.number > highestBidBlock + nextBidderBlockLimit with highestBidder set; noting nextBidderBlockLimit=10 (~30s) and that BSC block space is cheap and lacks private mempools, making bid suppression feasible.
**Exploitation:** Attacker needs capital for the minimum bid plus ~$14-15 per stuffed block (~11 blocks). They bid first at the floor price, saturate block space with dummy txs so no one can overbid within the 10-block window, then close the auction and capture the incentive while the protocol receives the least favorable price.
**Insight:** On cheap-gas, no-private-mempool chains, any auction whose anti-sniping window is a small fixed block count can be won by a single floor bid plus block stuffing; check the window length against the cost of filling blocks.