# Malicious user can overtake a prefunded auction and steal the deposited funds

Auctioneer.auction() writes routing to lotRouting[0] because lotId is still 0 at storage-pointer creation, letting an attacker overwrite a prefunded lot and cancel to steal funds.

- Payout: Contest reward
- Severity: high
- Program: Axis Finance
- Credited: 0xLogos
- Disclosed: 2024-03-14
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/12
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** AuctionHouse.auction() in Auctioneer.sol
**Root cause:** The named return variable lotId is initialized to 0, and `Routing storage routing = lotRouting[lotId]` binds the storage pointer before lotId is assigned lotCounter++. All auctions therefore write to lotRouting[0].
**Steps:**
1. Honest user calls `auction(routingParams, auctionParams, "")` with `prefunded=true`, depositing base tokens; routing is written to lotRouting[0].
2. Attacker calls `auction()` with same baseToken but `prefunded=false`; routing again resolves to lotRouting[0], overwriting seller to attacker while funding balance persists.
3. Attacker calls `cancel(0, "")`; contract refunds the prefunded base tokens to attacker as seller.
4. Assert attacker balance == prefunded amount, honest user balance == 0.
**How found:** Code reading of auction() noticed the named return lotId used to index lotRouting before being assigned, meaning the storage pointer always aliases index 0.
**Exploitation:** Attacker needs only to create a non-prefunded auction with the same base token as a victim's prefunded auction, then cancel lot 0 to receive the victim's deposited funds.
**Insight:** In Solidity, named return variables default to zero; any storage pointer indexed by a return variable before assignment silently aliases slot 0. Grep for `storage ... = mapping[returnVar]` patterns preceding the increment.