# DOS attack prevents refunding previous bid in Shortfall.sol and malicious bidder always wins the auction

Shortfall.sol refunds the prior highest bidder via push transfer; a blacklisted or ERC777-rejecting bidder blocks refunds, DoSing the auction so they always win.

- Payout: Contest reward
- Severity: medium
- Program: Venus Protocol
- Credited: berlin-101
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-venus-findings/issues/305
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Shortfall.sol auction placeBid refund logic
**Root cause:** placeBid pushes a refund to the previous highest bidder using SafeERC20 safeTransfer; if that transfer reverts (blacklisted address or ERC777 recipient rejecting tokens), the whole new bid reverts, blocking higher bids.
**Steps:**
1. Bidder 1 places a bid while not blacklisted (or via a contract that accepts ERC777 tokens).
2. Bidder 1 gets blacklisted (or contract toggled to reject tokensReceived).
3. Bidder 2 calls `placeBid` with a higher bid; contract attempts `safeTransfer` refund to bidder 1.
4. Refund reverts, so bidder 2's higher bid reverts.
5. Bidder 1 remains highest bidder and wins the auction.
**How found:** Code review of placeBid refund path; reasoned about weird-ERC20 behaviors (blacklist, ERC777 hooks) that SafeERC20 does not cover, since fee-on-transfer/rebase tokens were excluded but these were not.
**Exploitation:** Attacker bids, then makes their address unable to receive the underlying token (blacklist or ERC777 rejection). Any subsequent higher bid reverts on the refund push, so the attacker wins the auction at their low bid, harming Venus and users.
**Insight:** SafeERC20 only handles return-value quirks; it does not protect against tokens that revert on recipient (blacklists, ERC777 tokensReceived hooks). Any push-refund to an attacker-controlled or blacklistable address is a griefing/DoS vector—check every outbound transfer to a party the attacker controls.