# Missing debt check lets users start a debt auction of non-existent debt

AccountingEngine checks debtAuctionBidSize against unqueued debt before _settleDebt, so auctionDebt() starts auctions of non-existent debt, diluting the protocol token.

- Payout: Contest reward
- Severity: high
- Program: Open Dollar
- Credited: Saintcode\_
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-opendollar-findings/issues/24
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-opendollar%3AH-02
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic

**Target:** AccountingEngine.sol debt auction logic
**Root cause:** The check `debtAuctionBidSize > _unqueuedUnauctionedDebt(_debtBalance)` runs before `_settleDebt()` reduces the debt balance, so post-settlement debt can fall below the bid size while the auction still starts.
**Steps:**
1. Call `safeEngine.createUnbackedDebt(address(0), address(accountingEngine), rad(100 ether))`
2. Call `_popDebtFromQueue(100 ether)` to move debt out of the queue
3. Call `accountingEngine.auctionDebt()` directly; it internally calls `_settleDebt` after the bid-size check
4. Observe auction created despite insufficient remaining bad debt (whereas separate `settleDebt` then `auctionDebt` reverts)
**How found:** Code reading of AccountingEngine:181-183 ordering: noticed the bid-size check precedes `_settleDebt`, and compared the two-call flow (settle then auction, which reverts) against the single-call `auctionDebt()` path that succeeds.
**Exploitation:** Attacker triggers `auctionDebt()` when unqueued debt is just above debtAuctionBidSize but settlement drops it below; bidders then purchase debt that does not exist, diluting the protocol token.
**Insight:** When a function both validates a balance and then mutates it via an internal settle/accrue call, check whether the validation should run after the mutation; compare the direct entrypoint against the equivalent multi-transaction sequence to expose ordering bugs.