# Overflow in curate() function, results in permanently stuck funds

curate() adds curator fee to uint96 funding inside unchecked block; large prefunded auctions overflow, corrupting funding and permanently locking tokens.

- Payout: Contest reward
- Severity: high
- Program: Axis Finance
- Credited: dimulski
- Disclosed: 2024-03-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/88
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AH-7
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:precision-loss

**Target:** AuctionHouse.curate() / Routing.funding (uint96)
**Root cause:** routing.funding is uint96 and curatorFeePayout is added inside an unchecked block, so when prefunded amount plus fee exceeds uint96 max the addition wraps silently.
**Steps:**
1. Create prefunded FPAM auction with capacity `75_000_000_000e18` (75B tokens, 18 decimals) via `auctionHouse.auction(routingA, paramsA, infoHashA)`
2. Owner sets MaxCurator fee to 7500 (7.5%) via `auctionHouse.setFee(keycode, FeeType.MaxCurator, 7500)`
3. Curator calls `auctionHouse.setCuratorFee(keycode, 7500)` then `auctionHouse.curate(0, "")`
4. Observe `lotRouting(0).funding` wraps from 75B to ~1.396B while auction house holds 80.625B tokens
5. Run `forge test -vvv --mt test_CuratorFeeOverflow`
**How found:** Reasoned that memecoin supplies in the trillions with 18 decimals exceed uint96 (~80B max), then read curate() and spotted the unchecked `routing.funding += curatorFeePayout`, hypothesizing overflow on large prefunded auctions; confirmed with Foundry test.
**Exploitation:** No attacker profit path; a seller/curator legitimately curating a large prefunded auction triggers the overflow, after which routing.funding is corrupted and the excess tokens cannot be withdrawn or refunded via cancel.
**Insight:** When a struct field is a narrow uint (uint96/uint128) but token amounts are 18-decimal, check every arithmetic site touching it for unchecked blocks or unsafe downcasts; large-supply memecoins make these reachable in practice.