# It may be possible to DoS AuctionHouse by specifying malicious creators

Attacker registers 100 gas-burning creator contracts on an art piece so AuctionHouse._settleAuction consumes ~20M gas, risking permanent auction DoS.

- Payout: Contest reward
- Severity: medium
- Program: Collective
- Credited: bart1e
- Disclosed: 2024-02-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-revolutionprotocol-findings/issues/93
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-13
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** AuctionHouse._settleAuction / ERC20TokenEmitter.buyToken
**Root cause:** _settleAuction loops over up to 100 user-supplied creators, each receiving ETH via _safeTransferETHWithFallback (50k gas stipend) and ERC20/vote balance writes, with no cap on creator count or gas consumption.
**Steps:**
1. Deploy 100 contracts whose receive() runs an infinite loop.
2. Call CultureIndex.createPiece with those 100 addresses as creators and split bps.
3. Win the vote / get the piece auctioned and bid on it.
4. After auction ends, call settleCurrentAndCreateNewAuction(); _settleAuction iterates creators, each _safeTransferETHWithFallback burns its 50k stipend, plus buyToken writes nonzero balances/votes.
5. Measure gasleft() difference vs a single honest creator: ~20.5M gas.
**How found:** Code reading of _settleAuction's creator loop and its external calls; noticed unbounded creator count (100) and fixed 50k gas stipend per transfer, then reasoned about sstore 0->nonzero costs and wrote a Foundry PoC measuring gas delta.
**Exploitation:** Attacker must first win the art-piece vote, then each of 100 malicious creator contracts burns the full 50k gas stipend in receive(); combined with cold sstore 0->nonzero writes in buyToken/votes, settlement consumes ~20M gas, near the 30M block limit, making settlement expensive and potentially impossible if limits drop or opcode costs rise.
**Escalation:** Chains with a separate getArtPieceById-in-loop DoS and a heavy-NFT vector to push past the block gas limit.
**Insight:** When a settle/finalize loop iterates over user-registered recipients with fixed gas stipends, count the worst-case stipend * N plus cold sstore costs; a 100-entry loop with 50k stipend each is a latent gas bomb even below the current block limit.