# Bidder can cheat auction by placing bid much higher than reserve price when there are still open liens against a token

Astaria AuctionHouse records full bid amount as currentBid but only charges lien payoff when liens exist, letting bidder inflate bid and profit from refunds.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: TurnipBoy
- Disclosed: 2022-11-07
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/107
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-27
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AuctionHouse.createBid / _handleIncomingPayment
**Root cause:** When open liens exist, _handleIncomingPayment only pulls the lien payoff amount from the payer, but createBid sets currentBid to the full bid amount, so the recorded bid exceeds what was actually paid.
**Steps:**
1. Open auction on token with a single lien of 10 WETH
2. Call `createBid(tokenId)` with `msg.value = 20 WETH` as first bidder
3. Observe _handleIncomingPayment pays only 10 WETH against lien, skipping the else branch
4. currentBid is set to 20 WETH despite only 10 WETH collected
5. Get outbid; new bidder refunds 20 WETH to attacker, netting 10 WETH profit
**How found:** Code review of createBid and _handleIncomingPayment, noticing the else branch that transfers residual to owner is skipped when liens exist, causing a mismatch between amount charged and currentBid recorded.
**Exploitation:** Attacker bids far above reserve on a liened token, paying only the lien amount but recording a huge currentBid; when outbid, the next bidder's refund transfers the inflated amount to the attacker.
**Escalation:** Bid arbitrarily high (e.g. 500 ETH) to guarantee never being outbid or to maximize refund profit when outbid.
**Insight:** In auction contracts, verify that the amount actually collected equals the amount recorded as currentBid; lien/payout branches that skip residual transfer create accounting gaps exploitable via refunds.