# Adversary can block claimAuction() due to push-strategy to transfer assets to multiple bidders

NextGen's claimAuction() pushes ETH refunds to all bidders in one loop; a malicious bidder contract reverts or gas-bombs its receive(), blocking all refunds and the NFT transfer.

- Payout: Contest reward
- Severity: high
- Program: NextGen
- Credited: The\_Kakers
- Disclosed: 2024-01-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-nextgen-findings/issues/734
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-nextgen%3AH-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** AuctionDemo.sol claimAuction() auction settlement contract
**Root cause:** claimAuction() uses a push strategy, looping over all bidders and calling each with ETH in a single transaction; a malicious bidder contract can revert or consume all gas in its receive(), reverting the whole loop.
**Steps:**
1. Attacker places a minimal 1 wei bid from a malicious contract (no minimum bid enforced, AuctionDemo.sol#L58).
2. Auction ends; winner or admin calls `claimAuction(tokenid)`.
3. Loop reaches attacker's bid entry and executes `payable(bidder).call{value: bid}('')`.
4. Attacker's `receive()` reverts or gas-bombs (returns huge payload / burns gas), making the call fail or the tx run out of gas.
5. Whole `claimAuction()` reverts; no refunds, no NFT transfer, no owner payout.
**How found:** Code review of claimAuction()'s refund loop: noticed push-strategy external calls to arbitrary bidders, and that no minimum bid lets an attacker cheaply insert a reverting/gas-bombing contract into every auction.
**Exploitation:** Attacker bids 1 wei from a contract whose receive() reverts or consumes all gas. When claimAuction() iterates bidders and pushes ETH to the attacker, the call fails/gas-bombs, reverting the entire settlement so no other bidder is refunded, the winner gets no NFT, and the owner gets no funds.
**Escalation:** Attacker can repeat across many auctions at 1 wei cost each, griefing all auctions simultaneously.
**Insight:** When a settlement loop pushes ETH to every participant, check whether a zero/1-wei bid lets an attacker cheaply insert a contract that reverts or gas-bombs its receive(), bricking the whole batch; push-to-all refunds should be pull-based.