# Attacker can force pause the Auction contract.

Attacker caps gas on settleCurrentAndCreateNewAuction so token.mint() OOGs, catch block pauses Auction, halting DAO auctions.

- Payout: Contest reward
- Severity: medium
- Program: Nounsbuilder
- Credited: 0xMosh
- Disclosed: 2023-09-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-09-nounsbuilder-judging/issues/243
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-nounsbuilder%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** Auction.sol settleCurrentAndCreateNewAuction / _createAuction
**Root cause:** Broad `catch {}` in _createAuction treats any token.mint() revert, including out-of-gas, as a reason to _pause(); with high founder vesting percentages mint consumes >1.35M gas, so a 63/64 gas cap makes mint OOG while leaving 1/64 for _pause().
**Steps:**
1. Deploy DAO with founder percent >=51% so token.mint() vests many tokens and costs >1,359,036 gas
2. Attacker calls settleCurrentAndCreateNewAuction() via a contract using `call(1500000, target, 0, ptr, 4, 0, 0)` (or EOA with tight gas)
3. token.mint() consumes 63/64 of forwarded gas and reverts OOG
4. catch {} executes _pause() with remaining 1/64 (>=21572 gas)
5. Auction is paused; repeat after each unpause
**How found:** Noticed catch block changed from `catch Error(string memory)` to bare `catch {}`, meaning OOG reverts are now caught; combined with EIP-150 63/64 rule and high founder vesting gas cost to force mint failure while preserving gas for _pause().
**Exploitation:** Anyone (no access control on settleCurrentAndCreateNewAuction) submits a gas-capped call after auction end; mint OOGs, catch pauses contract, blocking DAO auctions until governance unpauses.
**Escalation:** Repeated pausing combined with long votingDelay/votingPeriod (up to 24 weeks each) can extend DoS up to ~336 days per cycle.
**Insight:** When a try/catch wraps an external call whose gas cost scales with state (e.g. vesting mints), a bare catch turns gas-griefing into a state-changing pause; check whether the 1/64 leftover suffices for the catch branch's side effects.