# The createMarket transaction lack of expiration timestamp check

Bond's createMarket lacks a deadline check, so a delayed transaction computes a shorter market length and inflated maxPayout, letting a purchaser extract excess payout tokens.

- Payout: Contest reward
- Severity: medium
- Program: Bond
- Credited: whitehat
- Disclosed: 2023-02-27
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-bond-judging/issues/60
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-bond%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** Auctioneer createMarket / purchaseBond contract functions
**Root cause:** createMarket derives market length from block.timestamp without a user-supplied deadline, so a transaction delayed in the mempool yields a much shorter length and a maxPayout computed against that tiny length.
**Steps:**
1. Submit `createMarket(params_)` with conclusion and depositInterval chosen for the intended creation time.
2. Transaction sits in mempool; it executes later when `block.timestamp` is close to conclusion.
3. `length = params_.conclusion - block.timestamp` becomes very small while still passing `length >= minMarketDuration`.
4. `market.maxPayout = capacity.mulDiv(depositInterval, length)` becomes far larger than intended.
5. Call `purchaseBond()` with amount sized to the inflated maxPayout; payout computed via `term.scale` exceeds expected, draining extra payout tokens before owner closes market.
**How found:** Compared Bond's forked Uniswap V2 addLiquidity pattern, which has an `ensure(deadline)` modifier, against createMarket which uses block.timestamp directly; noticed length and maxPayout depend on execution time.
**Exploitation:** Attacker waits for a createMarket tx to be delayed in the mempool, then purchases bonds against the mispriced market before the owner closes it, receiving unexpectedly large payout tokens.
**Insight:** When a contract forks a battle-tested router, diff the modifiers and deadline guards that were dropped; any parameter derived from block.timestamp at execution time (durations, expiries, caps) is mempool-delay sensitive.