# Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick`

flap.kick lacks bid validation, letting anyone create fake DAI-for-MKR auctions and yank arbitrary MKR from flap after end.cage.

- Payout: hidden
- Severity: high
- Program: BlockDev Sp. Z o.o
- Found by: lucash-dev
- Disclosed: 2019-09-26
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/684152
- Library page: https://bugbountylibrary.com/r/h1%3A684152
- Tags: area:web3 domain:web3 impact:funds-loss kind:bounty platform:hackerone sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** MCD_FLAP auction contract (flap.kick / flap.yank)
**Root cause:** flap.kick is public and never validates the bid parameter against actual DAI received, so an attacker can register an auction with an arbitrary bid and near-zero lot. flap.yank later pays out MKR equal to that unvalidated bid.
**Steps:**
1. During normal operation (not caged), call `flap.kick` directly with an arbitrarily large `bid` and a tiny nonzero `lot`, creating a fake auction at near-zero cost.
2. Repeat with an exponential series of bids (1, 2, 4, 8, 16...) to cover any target MKR amount.
3. Wait for governance to call `end.cage`, stopping auctions; outstanding MKR remains in flap until yank.
4. Call `flap.yank` on each fake auction to receive MKR from flap equal to the bid specified.
**How found:** Noticed flap.kick is publicly callable and its bid parameter is never validated, then reasoned that other contracts (yank) trust bid as the highest bid, enabling fake auctions.
**Exploitation:** Attacker pre-registers many fake auctions with exponentially increasing bids at negligible cost, then after end.cage calls yank on each to drain MKR held for outstanding auctions, extracting any exact amount.
**Escalation:** Accumulated MKR grants governance power, potentially enabling further attacks on collateral/DAI; also affects future contract versions using the same token.
**Insight:** In auction contracts, check whether kick/start functions are externally callable and whether the bid is trusted downstream by settlement/yank logic; unvalidated bid becomes a payout amount after shutdown.