# It is possible to DoS batch auctions by submitting invalid AltBn128 points when bidding

Missing field modulus check in ECIES.isValid allows invalid AltBn128 points, causing ecMul precompile revert and permanent DoS of batch auction decryption.

- Payout: Contest reward
- Severity: high
- Program: Axis Finance
- Credited: hash
- Disclosed: 2024-03-14
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/147
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AH-8
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** EMPAM.sol and ECIES.sol smart contracts
**Root cause:** ECIES.isValid() checks point is on curve but does not verify x and y coordinates are less than FIELD_MODULUS, allowing points outside the finite field.
**Steps:**
1. Submit a bid with bidPubKey = Point({x: FIELD_MODULUS + 1, y: 2}) via _bid; isValid passes because on-curve check uses modular arithmetic.
2. After auction concludes, call decryptAndSortBids(lotId, 1); _decrypt calls ECIES.decrypt with the invalid point.
3. ECIES.decrypt calls recoverSharedSecret, which calls _ecMul with the invalid point.
4. ecMul precompile (0x07) reverts because x >= FIELD_MODULUS, causing 'ecMul failed.' revert.
5. Decryption of all bids fails, auction never reaches Decrypted state, funds locked.
**How found:** Researcher reviewed ECIES.isValid() and noticed it only checks curve equation and excludes generator/infinity, but omits field modulus bounds. They hypothesized that a point with coordinate >= FIELD_MODULUS would pass validation but fail in ecMul precompile, then confirmed via Foundry test.
**Exploitation:** Attacker submits a single bid with an invalid public key (x = FIELD_MODULUS + 1, y = 2) that passes isValid. After auction ends, any attempt to decrypt bids reverts at ecMul precompile, preventing auction settlement and locking all bids and prefunded funds forever.
**Insight:** When validating elliptic curve points, always check coordinates are within the field modulus; precompiles like ecMul enforce this and will revert, so missing check can cause DoS in any protocol that decrypts user-supplied points.