# Malicious Actors Can Claim Users' Auction Bids

Chia auction puzzles never bind target_puzzle_hash to the bidder, so an attacker can RBF-overwrite a pending bid's payout target and steal the bid or its refund.

- Payout: Contest reward
- Severity: critical
- Program: Circuit Puzzles
- Credited: yakuhito
- Disclosed: 2025-08-21
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_circuit_puzzles.pdf#3.1.4
- Library page: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.4
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:critical tech:solidity technique:race-window technique:source-review vuln:business-logic

**Target:** Chia Clisp auction puzzles (recharge & surplus auction solutions)
**Root cause:** The auction puzzle solution's target_puzzle_hash is not asserted against any coin announcement or offer nonce, so it is freely mutable by whoever rebroadcasts the spend.
**Steps:**
1. Observe a pending bid transaction in the mempool targeting the recharge or surplus auction puzzle.
2. Rebroadcast the same spend with target_puzzle_hash replaced by the attacker's own puzzle hash and a higher fee (Chia RBF).
3. If outbid, the refund is redirected to the attacker; if the auction is won, proceeds go to the attacker's puzzle hash.
**How found:** Code review of surplus_bid.clsp line 12 noting no assertion ties target_puzzle_hash to the bidder; recognized auctions are multi-block so the parameter stays mutable until confirmation, enabling RBF substitution.
**Exploitation:** Attacker monitors the mempool for pending auction bids, replaces target_puzzle_hash in the solution with their own puzzle hash, and pays a small RBF fee bump to get the replacement confirmed first, capturing either the bid refund or the auction proceeds.
**Escalation:** Same unbound-parameter pattern flagged across announcer, oracle, savings, vault, treasury and governance puzzles, widening the attack surface beyond auctions.
**Insight:** On UTXO/coin-set chains, any solution field not pinned by a coin announcement or offer nonce is attacker-mutable via RBF during the multi-block window; grep puzzles for payout-destination parameters lacking assertions.