# Bidder's payout claim could fail due to validation checks in LinearVesting

LinearVesting.mint rejects expired derivatives, so bidders cannot claim auction payouts once the vesting expiry timestamp passes.

- Payout: Contest reward
- Severity: medium
- Program: Axis Finance
- Credited: Aymen0909
- Disclosed: 2024-03-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/178
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-5
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** AuctionHouse._sendPayout / LinearVesting derivative mint
**Root cause:** _sendPayout routes payouts through DerivativeModule.mint, and LinearVesting._validate returns false when data_.expiry < block.timestamp, reverting the claim.
**Steps:**
1. Seller creates auction with a LinearVesting derivative payout whose expiry is set in the near future
2. Bidder wins; payout is owed via _sendPayout -> module.mint
3. Wait until block.timestamp > derivative expiry
4. Bidder calls claim; _validate returns false and mint reverts with InvalidParams, blocking payout
5. For EMPAM, seller can withhold key reveal until after expiry to deny bidders
**How found:** Code reading of _sendPayout's call into module.mint and tracing LinearVesting._validate's expiry check against block.timestamp.
**Exploitation:** No direct theft; a malicious seller can grief bidders by setting a short derivative expiry or delaying EMPAM key reveal past expiry so claims revert permanently.
**Insight:** When a payout path mints a derivative, check whether the derivative's own validation (expiry, caps) can revert at claim time; seller-controlled derivative params become a griefing vector against bidders.