# Settlement of batch auction can exceed the gas limit

Axis Finance EMPAM settlement iterates all bids in gas-heavy loops, so ~580 bids push settlement past the block gas limit, bricking auctions and locking funds.

- Payout: Contest reward
- Severity: medium
- Program: Axis Finance
- Credited: 0xR360
- Disclosed: 2024-03-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/237
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-8
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** EMPAM batch auction settlement module (Solidity smart contract)
**Root cause:** Settlement computes the lot marginal price by iterating over every bid until capacity or min price is reached, with gas-intensive per-iteration operations; a second loop deletes all remaining bids. Bid count is unbounded, so settlement gas scales past the block limit.
**Steps:**
1. Set `_MIN_BID_PERCENT = 100` (0.1%) in `EMPAModuleTest.sol` to allow many small bids.
2. Create a lot, start it, and submit 580 bids via `_createBid(_BIDDER, 0.01e18, 0.01e18)`.
3. Conclude the lot, submit private key, decrypt the lot.
4. Call `_settle()` and measure `gasBefore - gasleft()`; assert it exceeds 30,000,000, i.e. settlement reverts on-chain.
**How found:** Code review of the settlement path: noticed the marginal-price loop iterates over all bids with gas-heavy operations and that bid count is only bounded by min bid percent, then wrote a Foundry test with 580 bids to confirm gas exceeds 30M.
**Exploitation:** Any bidder can spam many small bids (allowed by low min-bid-percent) so that settlement's bid-iteration loop exceeds the block gas limit; settlement permanently reverts, sellers and bidders cannot retrieve funds.
**Insight:** When a settlement/clearing routine loops over user-created entries, check whether entry count is bounded by an economic parameter (min bid size) rather than a hard cap; low minimums let an attacker inflate iteration count to exceed block gas. Also watch queue data structures optimized for insert but expensive on removal.