# Auctions can end in epoch after intended, underpaying withdrawers

AstariaRouter's epoch check ignored auction extensions up to 1 day, so extended auctions ended in a later epoch without a liquidation accountant, underpaying withdrawers.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: obront
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/51
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-31
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AstariaRouter.liquidate() epoch/auction-window check
**Root cause:** The liquidate() check `timeToEpochEnd() <= auctionWindow()` assumes auctions end within auctionWindow, but AuctionHouse extends auctions up to 1 extra day when bids land in the final timeBuffer, so auctions can end in a later epoch than accounted for.
**Steps:**
1. Read AstariaRouter.liquidate() check `if (PublicVault(owner).timeToEpochEnd() <= COLLATERAL_TOKEN.auctionWindow())`
2. Read AuctionHouse bid logic: if `firstBidTime + duration - block.timestamp < timeBuffer`, duration is extended up to maxDuration (max +1 day)
3. Observe the router check omits the possible 1-day extension
4. Trigger liquidation where timeToEpochEnd() is just above auctionWindow() but within auctionWindow()+1 days
5. Bid in final 15 minutes to extend auction past epoch boundary; auction settles in next epoch without liquidation accountant set up
**How found:** Code-reading comparison of the router's epoch check against AuctionHouse's auction-extension logic; noticed the check used auctionWindow() without the max 1-day extension.
**Exploitation:** Attacker/bidder bids within the final timeBuffer to extend the auction past the epoch boundary; the router had not set up a liquidation accountant for a future-epoch payout, so proceeds are misaccounted and withdrawers from the current epoch are underpaid.
**Insight:** When a protocol branches on 'will this auction/session end before deadline X', cross-check the auction engine's extension/anti-sniping logic — timeBuffer extensions silently push end times past the assumed window.