# Canceling an auction does not refund the current highest bidder

Astaria AuctionHouse.cancelAuction omits bidder refund logic present in createBid, so canceling an active auction strands the highest bidder's funds.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: bin2chen
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/202
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AuctionHouse.sol auction cancel flow
**Root cause:** cancelAuction() repays debt and returns collateral but never calls _handleOutGoingPayment() to refund the current highest bidder, unlike createBid() which refunds the prior bidder.
**Steps:**
1. Borrower opens loan with collateral token
2. Loan expires; auction starts via AuctionHouse
3. Bidder calls `createBid()` with amount >= reservePrice, funds escrowed
4. Borrower front-runs settlement and calls `cancelAuction()`, repaying reservePrice
5. Auction canceled; bidder's escrowed bid is never refunded
**How found:** Compared refund logic in createBid() (which refunds the previous bidder) against cancelAuction() and noticed the equivalent refund call was absent.
**Exploitation:** Malicious borrower lets loan expire, triggers auction, waits for a bid >= reservePrice, then front-runs the bid settlement by calling cancelAuction() to repay debt with the bidder's own escrowed funds, leaving the bidder unpaid.
**Insight:** When auditing auction/lending flows, diff the refund/settlement paths of every state transition (bid, cancel, settle) — a missing refund in one exit path strands escrowed funds.