# If pfBidder gets blacklisted the settlement process would be broken and every other bidders and the seller would lose their funds

In Axis Finance's batch auction settlement, a blacklisted partial-fill bidder causes settle() to revert, bricking refunds and locking all bidders' and seller's funds.

- Payout: Contest reward
- Severity: medium
- Program: Axis Finance
- Credited: Avci
- Disclosed: 2024-03-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/90
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** AuctionHouse.settle() / EMPAM batch auction settlement
**Root cause:** settle() transfers refund and payout to the partial-fill bidder inline; if that bidder is blacklisted on a blacklist-capable token (e.g. USDC), the transfer reverts and settlement can never complete.
**Steps:**
1. Bidder submits a bid in a batch auction where quote/base token supports blacklisting (e.g. USDC).
2. Bidder's bid is partially filled; settlement.pfBidder is set to that bidder.
3. Bidder's address gets blacklisted before settlement.
4. Call `AuctionHouse.settle(lotId)`; `Transfer.transfer(routing.quoteToken, settlement.pfBidder, settlement.pfRefund, false)` reverts.
5. refundBid() reverts via `_revertIfLotConcluded`; claimBids() reverts since lot unsettled; seller cannot cancel() or claimProceeds().
**How found:** Code review of settle()'s partial-fill branch, noticing inline transfers to pfBidder and cross-checking refundBid()/claimBids()/cancel() preconditions to confirm no alternative exit exists.
**Exploitation:** No attacker action required beyond the bidder being blacklisted; the settlement transaction reverts permanently, freezing all bidders' refunds and the seller's prefunded tokens with no recovery path.
**Insight:** When settlement loops over user-supplied addresses with token transfers, check whether any single recipient can revert the whole batch (blacklist, blocklist, paused token) and whether per-user refund/claim paths remain open after the batch step fails.