# Auction timers following liquidity can fall through the floor price causing pool insolvency

Ajna auction price decays below pool floor price, letting takers buy collateral cheaply and leaving lenders unable to recover debt, causing insolvency.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: CRYP70
- Disclosed: 2022-12-21
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-ajna-judging/issues/76
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-16
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** ERC20 pool liquidation auction (Auctions.sol _auctionPrice)
**Root cause:** _auctionPrice() computes a time-decaying price without a floor tied to the pool's fenwick index, so auctioned collateral can be bought below the price lenders loaned at.
**Steps:**
1. Deploy DAI/WETH ERC20 pool at interest rate 0.05e18.
2. LPs add quote tokens at fenwick 5635 (~1600 DAI/WETH).
3. Borrower draws 2 WETH debt against 3200 DAI collateral.
4. Warp 62 days; call `kick(borrower)` to start auction.
5. Warp 10 hours so auction price decays below floor.
6. Taker calls `take(borrower, 1000 ether, taker, "")` repeatedly (simulating flash loan) to buy collateral cheaply.
7. Call `settle(borrower, 100)`; pool balance remains ~9.15 WETH instead of 11 WETH.
8. LPs `removeQuoteToken`; bob recovers 1007 of 1009 WETH, alice 1.6 of 2 WETH — insolvency.
**How found:** Code review of _auctionPrice() in Auctions.sol noticing the price formula lacks any floor bound relative to the pool's fenwick index, then modeling a liquidation where decay outpaces recovery.
**Exploitation:** Attacker waits for auction price to decay below pool floor, then uses flash-loaned capital to repeatedly call take() and acquire collateral at a fraction of value, then settles; lenders absorb the shortfall.
**Insight:** In decaying-price liquidation auctions, check whether the price curve has a lower bound tied to the loan's bucket/fenwick; if not, a taker can wait out the decay and buy collateral below the lenders' cost basis, so model worst-case auction duration vs. floor.