# Incorrect calculations for Surplus Auction creation cause massive surplus imbalances

AccountingEngine.auctionSurplus used ONE_HUNDRED_WAD instead of WAD, inflating surplus auction _amountToSell ~100x and creating ghost auctions at 100% transfer.

- Payout: Contest reward
- Severity: high
- Program: Open Dollar
- Credited: falconhoof
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-opendollar-findings/issues/26
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-opendollar%3AH-01
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:precision-loss

**Target:** AccountingEngine.sol auctionSurplus() surplus auction creation
**Root cause:** Percentage math used ONE_HUNDRED_WAD (100e18) instead of WAD (1e18) in both the < check and the wmul subtraction, so the 100% guard never triggers and _amountToSell is ~100x too large.
**Steps:**
1. Set surplusTransferPercentage = 1e18 (100%), surplusAmount = 3e18.
2. Call `auctionSurplus()`; line 213 `if (_params.surplusTransferPercentage < ONE_HUNDRED_WAD)` is true since 1e18 < 100e18.
3. Auction starts with `_amountToSell = 3e18.wmul(100e18 - 1e18) = 297e18` instead of 0.
4. Lines 224-231 also transfer full surplusAmount to extraSurplusReceiver, double-counting.
**How found:** Code reading of auctionSurplus percentage math: noticed the guard compared against ONE_HUNDRED_WAD while the earlier check caps surplusTransferPercentage at WAD, making the branch always true and the wmul factor ~100x.
**Exploitation:** Attacker triggers auctionSurplus with 100% transfer percentage; a ghost surplus auction sells 297e18 system coins backed by only 3e18 surplus while the full surplus is also paid out, letting the attacker buy inflated system coins cheaply and destabilize protocol accounting.
**Insight:** When a function caps a percentage at WAD earlier, any later comparison or wmul against ONE_HUNDRED_WAD is a red flag; trace every percentage constant to its intended scale.