# Downcasting to uint96 can cause assets to be lost for some tokens

EMPAM settlement downcasts summed bid totalAmountIn to uint96, so auctions with many bids exceeding uint96 max truncate and lose funds.

- Payout: Contest reward
- Severity: high
- Program: Axis Finance
- Credited: FindEverythingX
- Disclosed: 2024-03-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/181
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AH-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:precision-loss

**Target:** EMPAM auction settlement module (Solidity)
**Root cause:** settlement_.totalIn = uint96(result.totalAmountIn) casts a uint256 sum of many uint96 bids without bounds check; sum of many bids can exceed type(uint96).max even though each bid and the lot capacity are uint96.
**Steps:**
1. Seller creates lot with uint96 capacity (e.g. 3e6*1e18 base tokens) and a price such that capacity*price > type(uint96).max
2. Multiple buyers place bids each with amountIn < type(uint96).max (e.g. 10 bids of ~9.8e27)
3. Sum of amountIn in _getLotMarginalPrice exceeds type(uint96).max
4. In _settle, `settlement_.totalIn = uint96(result.totalAmountIn)` truncates the sum
5. Auction settles with truncated totalIn, auctioneer loses the excess proceeds
**How found:** Code review of the settlement path: noticed unchecked downcast of summed bid amounts to uint96; reasoned that capacity being uint96 does not bound totalAmountIn since amountIn is quote-token amount, and computed SHIB example showing ~$2.5M value fits in uint96.
**Exploitation:** No attacker action needed; occurs naturally when a well-traded/low-price token auction accumulates bids summing above uint96 max, causing silent truncation of totalIn at settlement and loss of auction proceeds.
**Insight:** When a struct field is uint96, don't assume sums derived from it stay bounded—quote-token totals scale with price and can exceed the base-token capacity bound; check every downcast of an accumulator separately from its inputs.