# Auction creators have the ability to lock bidders' funds.

At the exact conclusion timestamp, boundary-check mismatch lets auction creators cancel a finished auction, locking bidders' quote tokens permanently.

- Payout: Contest reward
- Severity: high
- Program: Axis Finance
- Credited: KiroBrejka
- Disclosed: 2024-03-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/66
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AH-4
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** EMPAM batch auction module (Auction.sol / EMPAM.sol)
**Root cause:** cancelAuction's _revertIfLotConcluded uses strict `<` while _revertIfLotActive uses `conclusion > block.timestamp`, so at block.timestamp == conclusion both checks pass and cancellation is allowed after the auction ended.
**Steps:**
1. Create an auction with start=1, conclusion=86401.
2. Warp to block.timestamp == lot.conclusion (86401).
3. Call `cancelAuction(lotId)` via auction house; both _revertIfLotConcluded and _revertIfLotActive pass.
4. Auction status becomes Claimed and capacity becomes 0.
5. Bidders' refundBid reverts (capacity==0) and claimBids reverts (status not Settled); creator can submit private key with num=0 so decryptAndSortBids always reverts, blocking settlement.
**How found:** Code reading of the boundary conditions: noticed _revertIfLotConcluded uses `<` while _revertIfLotActive uses `conclusion > block.timestamp`, leaving the equality timestamp uncovered; confirmed with a Foundry test warping to conclusion.
**Exploitation:** Auction creator waits until the conclusion timestamp, cancels the auction to avoid unfavorable settlement, then submits the private key without decrypting bids so the auction can never reach Settled; bidders' quote tokens remain locked in the auction house.
**Insight:** When two guards use complementary comparisons (`<` vs `>`), the equality point is a gap — check every timestamp/amount boundary where one check uses strict and the other non-strict inequality.