# Wrong auctionPrice used in calculating BPF to determine bond reward (or penalty)

Ajna's depositTake path computes BPF from auctionPrice instead of bucketPrice, overpaying bond rewards to the taker and mispricing debt repayment.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: CL001
- Disclosed: 2023-09-26
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-09-ajna-judging/issues/16
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-ajna%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TakerActions.sol bucketTake/_prepareTake liquidation logic
**Root cause:** _prepareTake computes BPF using vars.auctionPrice before _takeBucket overwrites auctionPrice with bucketPrice for depositTake, so BPF uses the lower auction price instead of the bucket price.
**Steps:**
1. Call bucketTake with params_.depositTake=true on an auction where auctionPrice < bucketPrice.
2. _prepareTake runs _bpf(..., vars.auctionPrice) using the fallen auction price.
3. _takeBucket later sets vars_.auctionPrice = vars_.bucketPrice only after BPF is fixed.
4. _calculateTakeFlowsAndBondChange and _rewardBucketTake use the inflated BPF, yielding excess LPB reward and reduced debt repayment.
**How found:** Compared whitepaper section 7.4.2 Deposit Take example (BPF using bucket price 1100) against code, noticing _takeBucket overwrites auctionPrice only after _prepareTake already used it for BPF.
**Exploitation:** A taker calls depositTake when auction price has fallen below the bucket price; the miscomputed BPF yields a larger bond/LPB reward (e.g. 205.58 DAI vs 166.82 DAI in the whitepaper example) and less debt repaid, extracting extra value from the liquidation.
**Insight:** When a function mutates a shared local (auctionPrice) after a dependent computation (BPF), check ordering: spec-defined price substitutions must occur before any derived factor is computed.