# Auction manipulation by block stuffing and reverting on ERC-777 hooks

Short 30-min auction on L2 lets attacker block-stuff to suppress bids, buying full collateral for near-zero CREDIT and causing term-wide slashing.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: Cosine
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/685
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-16
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:dos vuln:liquidation

**Target:** AuctionHouse.sol auction bidding on L2 deployment
**Root cause:** Auction duration/midPoint immutables set too short (1800s/650s) in GIP_0 deployment, so an attacker can cheaply fill L2 blocks to prevent competing bids until the CREDIT ask decays.
**Steps:**
1. Deploy/observe AuctionHouse with midPoint=650, auctionDuration=1800 from GIP_0.sol
2. Borrow via a contract whose ERC-777 hook reverts on collateral return when tx.origin != attacker, so pre-midPoint bids revert
3. Let loan go to auction; skip block stuffing until midPoint since early auction is unprofitable
4. After midPoint, stuff blocks (e.g. ~$6.39/block on Optimism, +10% base fee per full block) to block competing bids
5. Bid when creditAsked has decayed, receiving full collateral for far less CREDIT than borrowed
6. Loss triggers notifyPnL -> notifyGaugeLoss -> applyGaugeLoss, burning all stakers' gauge weight on that term
**How found:** Read deployment script GIP_0.sol immutables and getBidDetail decay math, combined with L2 block time/gas cost estimates to show block stuffing is cheap relative to auction profit.
**Exploitation:** Attacker borrows with ERC-777 collateral contract that reverts on collateral return, waits out first auction phase for free, then block-stuffs L2 blocks past midPoint to suppress liquidators and bids at a decayed CREDIT price, capturing collateral cheaply and forcing term-wide slashing.
**Escalation:** ERC-777 revert-on-receive hook removes need to stuff blocks during first phase, cutting attack cost; stuffing to creditAsked=0 steals nearly full loan amount.
**Insight:** Check deployment/config scripts (not just core contracts) for short auction or liquidation windows; on L2s with cheap full blocks and FCFS sequencers, time-based Dutch auction decay can be gamed by stuffing blocks, and ERC-777 revert hooks can subsidize the wait.