# Function `_indexOf` will cause a settlement to revert if `auctionPrice > MAX_PRICE`

In Ajna ERC721 pools, settling an auction with fractional collateral reverts when auctionPrice exceeds MAX_PRICE, temporarily blocking settlement and harming the borrower.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: santipu_
- Disclosed: 2023-09-26
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-09-ajna-judging/issues/30
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-ajna%3AM-5
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Ajna ERC721 pool auction settlement (SettlerActions._settleAuction / PoolHelper._indexOf)
**Root cause:** _settleAuction calls _indexOf(auctionPrice) to find the bucket for fractional collateral compensation, but _indexOf reverts when price_ > MAX_PRICE. referencePrice can be up to MAX_INFLATED_PRICE (50x MAX_PRICE), so auctionPrice can exceed MAX_PRICE early in the auction.
**Steps:**
1. Create/observe an ERC721 pool with extreme asset valuation difference (e.g. BTC/SHIBA) where auctionPrice can exceed MAX_PRICE (1_004_968_987 * 1e18).
2. Borrower has fractional collateral (e.g. 1.5e18) and is kicked; referencePrice = min(max(htp, neutralPrice), MAX_INFLATED_PRICE) can exceed MAX_PRICE.
3. Call take/settle while auctionPrice > MAX_PRICE and borrower_.t0Debt reaches 0, triggering _settleAuction.
4. `bucketIndex = auctionPrice > MIN_PRICE ? _indexOf(auctionPrice) : MAX_FENWICK_INDEX;` reverts with BucketPriceOutOfBounds.
5. Settlement remains blocked until auctionPrice decays below MAX_PRICE (~72h window).
**How found:** Code reading of _settleAuction's call to _indexOf and noticing _indexOf reverts above MAX_PRICE, then tracing that referencePrice can be up to 50x MAX_PRICE via MAX_INFLATED_PRICE, making auctionPrice > MAX_PRICE reachable.
**Exploitation:** A malicious lender can kick a well-collateralized borrower knowing settlement reverts until auctionPrice < MAX_PRICE; the auction continues decaying, letting the kicker profit from the bond at the borrower's expense. In ERC721 pools with fractional collateral, takers cannot fully repay debt without triggering the revert, so the last NFT unit settles at an unfairly low price.
**Escalation:** Restricting to ERC721 pools with fractional collateral (e.g. 1.5e18) where the minimum 1e18 take rounding prevents avoiding _settleAuction; impact grows with extreme-valuation pairs.
**Insight:** When a helper validates an input range, check every caller's input domain: auctionPrice derives from referencePrice bounded by MAX_INFLATED_PRICE (50x MAX_PRICE), so a downstream MAX_PRICE check in _indexOf is reachable. Also check ERC721 rounding paths that force settlement.