# ShortFall contract might transfer an incorrect amount of tokens to the highest bidder.

Shortfall.closeAuction transfers riskFundBidAmount of convertibleBaseAsset directly, mixing USD-denominated debt with token units, overpaying bidders when base asset isn't USD-pegged.

- Payout: Contest reward
- Severity: medium
- Program: Venus Protocol
- Credited: fs0c
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-venus-findings/issues/222
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Shortfall auction closeAuction / convertibleBaseAsset transfer
**Root cause:** poolBadDebt is computed in USD via oracle, but closeAuction transfers riskFundBidAmount units of convertibleBaseAsset without converting USD value back into base-asset token units.
**Steps:**
1. Set convertibleBaseAsset to a non-USD-pegged token (e.g. BNB at $100/1e18).
2. Trigger LARGE_RISK_FUND auction; poolBadDebt computed in USD (e.g. 200e18).
3. seizedRiskFund = poolBadDebt + incentive (e.g. 220e18).
4. Call `closeAuction(comptroller)`; riskFundBidAmount = seizedRiskFund * highestBidBps / MAX_BPS.
5. Observe `IERC20Upgradeable(convertibleBaseAsset).safeTransfer(highestBidder, riskFundBidAmount)` sends 220e18 tokens worth $22000 instead of $220.
**How found:** Code reading of closeAuction noticed riskFundBidAmount (USD-denominated from poolBadDebt) is transferred directly as convertibleBaseAsset units without oracle conversion; hypothesized non-USD-pegged base asset causes unit mismatch.
**Exploitation:** Attacker becomes highest bidder on a LARGE_RISK_FUND auction where convertibleBaseAsset is not USD-pegged; closeAuction transfers riskFundBidAmount raw tokens, so bidder receives tokens worth far more than the USD debt value they bid against.
**Insight:** When a protocol mixes USD-denominated accounting (oracle-priced debt) with raw token transfers, check every transfer site for a missing reverse conversion into the payout token's units and decimals.