# Anyone can pause AuctionHouse in _createAuction

Anyone can call settleCurrentAndCreateNewAuction with crafted gas so verbs.mint() OOGs, triggering the catch block that pauses AuctionHouse.

- Payout: Contest reward
- Severity: medium
- Program: Collective
- Credited: bart1e
- Disclosed: 2024-02-08
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-12-revolutionprotocol-findings/issues/195
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-09
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** AuctionHouse.sol / VerbsToken.sol smart contracts
**Root cause:** _createAuction wraps verbs.mint() in a try/catch that calls _pause() on any failure, including deliberate out-of-gas; the MIN_TOKEN_MINT_GAS_THRESHOLD guard is insufficient because mint() gas cost is attacker-influenceable (creator array pushes, metadata size, MaxHeap depth).
**Steps:**
1. Create an art piece with ~10 creators (or large metadata) so mint() storage writes exceed 750k gas.
2. Finish the current auction and ensure another piece is queued.
3. Call `auction.settleCurrentAndCreateNewAuction{gas: 2_900_000}()` from any address.
4. verbs.mint() runs out of gas inside the try, catch executes `_pause()`, AuctionHouse becomes paused.
**How found:** Read _createAuction's try/catch and noticed catch also swallows OOG; sponsors added a gasleft() guard, so researcher enumerated gas-heavy operations inside verbs.mint() (dropTopVotedPiece heap iteration, metadata copy, creator push loop) that an attacker can inflate to defeat the guard.
**Exploitation:** Attacker supplies just enough gas so that the costly mint() (many creator pushes / big metadata / deep MaxHeap) exhausts gas after passing the MIN_TOKEN_MINT_GAS_THRESHOLD check, forcing the catch branch to pause the AuctionHouse; DAO must pass a governance proposal to unpause.
**Insight:** When a contract uses try/catch to pause on mint failure, check whether the guarded operation's gas cost is attacker-controllable (array lengths, metadata size, heap depth); a fixed gasleft() threshold is bypassable if any input inflates gas usage past it.