# Bidder can use donations to get VerbsToken from auction that already ended

Bidder donates ETH via selfdestruct to AuctionHouse so its balance meets a raised reservePrice, settling an ended auction at the lower bid amount.

- Payout: Contest reward
- Severity: medium
- Program: Collective
- Credited: jnforja
- Disclosed: 2024-02-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-revolutionprotocol-findings/issues/515
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** AuctionHouse.sol settleCurrentAndCreateNewAuction / _settleAuction
**Root cause:** _settleAuction checks address(this).balance against reservePrice instead of _auction.amount, so any ETH forced into the contract (selfdestruct) satisfies the reserve check while payouts use the lower bid amount.
**Steps:**
1. Attacker calls `auction.createBid{value: bidAmount}(0, bidder)` at current reservePrice.
2. Owner calls `auction.setReservePrice(reservePrice + 0.1 ether)` raising reserve above the bid.
3. No new bids; `vm.warp` past auction duration.
4. Attacker deploys a contract funded with the delta and calls `selfdestruct(auction)` to force ETH into AuctionHouse, making `address(auction).balance >= reservePrice`.
5. Attacker calls `auction.settleCurrentAndCreateNewAuction()`; token transfers to bidder, payouts computed from `_auction.amount` (lower than reservePrice).
**How found:** Code reading of _settleAuction revealed the reserve check uses contract balance rather than the recorded bid amount, making it manipulable by forced ETH transfer.
**Exploitation:** Attacker places a bid at the old reserve, waits for the DAO to raise reservePrice mid-auction, then force-feeds the shortfall via selfdestruct so the balance check passes and settlement awards the NFT at the stale bid price, shortchanging creators and AuctionHouse owner.
**Insight:** When a contract validates a condition against `address(this).balance`, look for ways to inflate balance without going through the intended deposit path (selfdestruct, coinbase, pre-funded CREATE2) to satisfy checks that should reference recorded state.