# Malicious users can exploit the auction and make profit when the SetToken is not locked.

Unlocked SetToken during rebalance lets an attacker sandwich a bidder's bid via mint/redeem, extracting auction profit and blocking the auction from reaching target.

- Payout: Contest reward
- Severity: medium
- Program: Index
- Credited: ast3ros
- Disclosed: 2023-06-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-Index-judging/issues/57
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-Index%3AM-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** AuctionRebalanceModuleV1 / BasicIssuanceModule SetToken rebalance auction
**Root cause:** When SetToken is not locked during rebalancing, anyone can mint/redeem via BasicIssuanceModule, so totalSupply can be inflated around a bid, diluting the bid's effect on positionUnit and letting the minter capture the gap between auction price and market price.
**Steps:**
1. Manager starts rebalance with unlocked SetToken and a linear price curve (e.g. WETH 2000->1900, quote USDC).
2. Bidder submits `bid()` for 5 WETH at 1950 USDC (above market 1940).
3. Attacker front-runs: mints 10 SetToken with 10 WETH via BasicIssuanceModule, doubling totalSupply to 20.
4. Bidder's bid executes, moving positionUnit only partway toward target.
5. Attacker back-runs: redeems 10 SetToken for 7.5 WETH + 4875 USDC, netting ~25 USDC profit and preventing auction completion.
**How found:** Code review of AuctionRebalanceModuleV1's unlocked rebalance path combined with BasicIssuanceModule mint/redeem, reasoning that totalSupply changes alter positionUnit math and enable sandwiching of bids.
**Exploitation:** Attacker observes a pending bid priced above market, mints a large SetToken amount before it, lets the bid fill, then redeems after, capturing the price gap as risk-free profit while the auction fails to reach target.
**Escalation:** MEV bots can scale mint/redeem size to extract most of the bid's value; supply cap (e.g. 2x) proposed as mitigation.
**Insight:** In auction/rebalance designs, check whether supply-changing functions (mint/redeem) are callable mid-auction; if positionUnit is computed against totalSupply, an attacker can dilute a bid's effect and arbitrage the auction price vs market price.