# Users can create overpriced bad debt and interest auctions by providing duplicate reserves

Blend's interest/bad-debt auction creation looped over user-supplied reserves without dedup, letting duplicate reserves inflate auction bid/lot value and bypass minimum checks.

- Payout: Contest reward
- Severity: medium
- Program: Blend
- Credited: 0xAlix2
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Soroban pool auction creation (create_interest_auction_data / create_bad_debt_auction_data)
**Root cause:** The lot loop sums backstop_credit value per provided asset without tracking seen assets, so the same reserve passed multiple times is counted repeatedly, inflating interest_value and the computed bid (or lot for bad debt).
**Steps:**
1. Set up pool with reserves U0 (backstop_credit 100) and U1 (backstop_credit 25) and mock oracle prices.
2. Call `create_interest_auction_data` with lot `[U0, U1]`; observe bid = 288 backstop tokens.
3. Delete auction, then call again with lot `[U0, U1, U0, U1]`.
4. Observe bid = 576 backstop tokens, double the fair value, bypassing minimum interest value check.
**How found:** Code review of the auction lot loop noticed it iterates provided assets and accumulates value without any duplicate check, then tested by passing the same reserves twice and comparing bid amounts.
**Exploitation:** Attacker creates an interest auction passing the same reserve many times, inflating the bid (backstop tokens a filler must pay) relative to the actual lot credit, or inflating the lot in a bad-debt auction; fillers may overpay or the auction misprices, limited by max_positions (e.g. 15 duplicates).
**Escalation:** Impact bounded by max_positions cap; with 15 duplicates the mispricing is ~15x, and large step size (0.5%/block) can worsen filler economics or give lot away free if unfilled.
**Insight:** When an auction or batch function accepts a caller-supplied list of assets and sums per-asset values, check whether duplicates are deduplicated; a repeated entry can multiply computed totals and bypass minimum/maximum thresholds.