# ## Auction can be ended with large limit order

A limit order priced at type(int128).max collides with the sentinel value used to mark a canceled auction, letting an attacker finalize and refund, blocking the auction.

- Payout: Contest reward
- Severity: medium
- Program: Knox
- Credited: ArbitraryExecution
- Disclosed: 2022-09-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-knox-judging/issues/153
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-knox%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** Auction contract (_previewWithdraw / limit order logic)
**Root cause:** _previewWithdraw uses type(int128).max as a sentinel for the canceled-auction state, but limit orders at that price pass all require checks, so a legitimate order is indistinguishable from cancellation.
**Steps:**
1. Place a limit order covering all contracts at price `type(int128).max` at auction start
2. Order passes limit-order require checks
3. _previewWithdraw interprets the price as the canceled sentinel
4. Auction is finalized/canceled and trader refunded in full
**How found:** Code reading of _previewWithdraw revealed type(int128).max used as a cancellation sentinel, then checked whether a valid limit order could reach that same value.
**Exploitation:** Attacker submits a max-price limit order for the full contract amount at auction start; the sentinel collision causes the auction to be treated as canceled, refunding the trader and preventing the auction from proceeding.
**Insight:** When a magic sentinel value doubles as a valid input domain value, craft an input equal to the sentinel to spoof the special state; prefer explicit status enums over in-band sentinels.