# Bids cannot be created within timeBuffer of completion of a max duration auction

AuctionHouse.createBid underflows when extending a max-duration auction, reverting all late bids and ending auctions early.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: csanuragjain
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/18
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AM-25
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** AuctionHouse.sol createBid() auction extension logic
**Root cause:** When a bid lands within timeBuffer of a max-duration auction, duration is set to maxDuration - firstBidTime, subtracting a timestamp from a duration, causing underflow and revert.
**Steps:**
1. Start an auction with duration == maxDuration (3 days).
2. Wait until block.timestamp is within timeBuffer of firstBidTime + duration.
3. Call `createBid(tokenId)`; the branch `firstBidTime + duration - block.timestamp < timeBuffer` triggers.
4. newDuration exceeds maxDuration, so code executes `auctions[tokenId].duration = maxDuration - firstBidTime`, which underflows and reverts.
**How found:** Code reading of createBid's timeBuffer extension branch, noticing maxDuration (a duration) is subtracted by firstBidTime (a timestamp), which cannot be valid.
**Insight:** When a contract mixes duration and timestamp units in arithmetic, check every subtraction for unit mismatch; max-duration auctions are the edge case that exposes it.