# Unsold tokens from a FPAM auction, will be stuck in the protocol, after the auction concludes

Prefunded FPAM auctions on Axis Finance leave unsold base tokens permanently stuck after conclusion, since cancel reverts once the auction ends.

- Payout: Contest reward
- Severity: medium
- Program: Axis Finance
- Credited: Aymen0909
- Disclosed: 2024-03-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/94
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** AuctionHouse / FixedPriceAuctionModule (FPAM) prefunded auctions
**Root cause:** cancelAuction reverts via _revertIfLotConcluded once the auction concludes, and no post-conclusion withdrawal path exists for unsold prefunded base tokens.
**Steps:**
1. Create prefunded FPAM auction with capacity 75B base tokens, price 1e18, maxPayoutPercent 1e5
2. Buyer purchases 10B quote worth, leaving 65B base tokens in AuctionHouse
3. skip(86401) past 1-day conclusion
4. Call `auctionHouse.cancel(0, "")` as seller -> reverts `Auction_MarketNotActive(0)`
5. Confirm no other function returns remaining base tokens to seller
**How found:** Code reading of cancelAuction/_revertIfLotConcluded: noticed cancel is the only refund path for prefunded auctions and it is gated on auction being active, so concluded auctions with leftover capacity have no exit.
**Exploitation:** No attacker profit; seller's unsold prefunded base tokens become permanently locked in the AuctionHouse contract after auction conclusion.
**Insight:** For prefunded/escrowed auction models, check every refund path's lifecycle guards: if the only withdrawal function reverts after conclusion, partial-fill auctions strand seller funds. Test partial fills plus time skip, not just full fills or cancellation.