# Attacker can forbid users to get refunded if sends enough bids on the EMPAM module

Attacker floods EMPAM auction with minimum-size bids so refundBid's linear scan over the bid array runs out of gas, blocking later users' refunds.

- Payout: Contest reward
- Severity: medium
- Program: Axis Finance
- Credited: 0xR360
- Disclosed: 2024-03-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/41
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-1
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** EMPAM auction module refundBid (Solidity smart contract)
**Root cause:** refundBid linearly iterates the encrypted-bid array to locate the requested bidId and pop it; array length is attacker-controllable via cheap minimum-amount bids, so the loop exceeds block gas limit.
**Steps:**
1. Attacker submits ~60000 valid bids at the minimum allowed amount right after auction creation via `_createBid(1e18, 1e18)`.
2. Victim submits a bid `_createBid(2e18, 1e18)` after the attacker's bids.
3. Victim calls `refundBid(_lotId, victimBidId, bidder)`; the module loops over all preceding bids to find the index.
4. Gas consumed exceeds the 30M block gas limit, reverting the refund.
**How found:** Code review of refundBid's loop over the bid array; recognized array length is attacker-influenced and wrote a Foundry test with 60000 bids asserting gasUsed > 30M block gas limit.
**Exploitation:** Griefing DoS: attacker pays only minimum bid amounts to inflate the bid array, making any later bidder's refund transaction revert out-of-gas, locking their funds in the auction.
**Insight:** Any per-user action that linearly scans a shared, user-growable array (bids, orders, entries) is a griefing DoS vector; check whether an attacker can cheaply inflate the array with minimum-size entries and push victims' operations past block gas limits.