# The tradeEnd in BackingManager isn’t updating correctly

BackingManager sets tradeEnd to a Dutch auction's full endTime, so a settled-early auction blocks new Dutch auctions for up to a week.

- Payout: Audit contest
- Severity: medium
- Program: Reserve
- Found by: ether_sky
- Disclosed: 2024-10-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-07-reserve#m-07
- Library page: https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** BackingManager.rebalance / settleTrade (Solidity smart contract)
**Root cause:** tradeEnd[kind] is set to trade.endTime() at auction creation and never reset on early settlement, so the same-block DoS guard blocks new auctions of that kind until the original endTime passes.
**Steps:**
1. Create a Dutch auction of length up to MAX_AUCTION_LENGTH (1 week) at time T; `tradeEnd[kind] = T + 7 days`.
2. Basket asset goes IFFY; settle the auction early at T+1d via `settleTrade`, which calls `rebalance` internally (passes the `_msgSender()==address(this)` check) but fails `basketHandler.isReady()`.
3. Asset recovers to SOUND at T+2d; basket ready after MIN_WARMUP_PERIOD (60s).
4. Call `rebalance(Dutch)` — reverts `already rebalancing` because `tradeEnd[kind]` is still T+7d.
**How found:** Code reading of the rebalance DoS guard comment at line 114 and the tradeEnd assignment at line 166, then reasoning about Dutch auctions that can settle before endTime combined with BasketHandler IFFY/warmup timing.
**Exploitation:** Not attacker-profitable directly; a Dutch auction settled before its endTime leaves tradeEnd stale, preventing any new Dutch auction of that kind until the original endTime, forcing fallback to Batch trades.
**Escalation:** Impact amplified if GnosisTrade reportViolation() pauses Batch trades, leaving no efficient trading path.
**Insight:** When a timestamp guard is written at auction creation but auctions can terminate early, check whether the guard is reset on settlement; Dutch-style auctions with long max durations are prime candidates.