# Auction timing and settlement griefing

Auction end, duration, or settlement checks outsiders can extend, shorten, or satisfy without authorization

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-02-22. Updated 2026-10-24._

## How it works
Auction code assumes its timing parameters and payment checks bound when an auction ends and who may settle it. That assumption breaks when the configured window is short enough that an outsider can cheaply suppress competition for its whole length [E1](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-16.md); when settlement trusts a balance any outsider can top up [E2](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-30.md); or when a caller reasons about auction end using a nominal window while the auction engine can extend it [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-31.md). The code's notion of "when/how the auction resolves" diverges from the engine's real behavior, and an outsider who controls timing or payment state captures the asset or blocks the intended settlement.

## Where it shows up
- Short auction durations or midpoints set in deployment/config scripts, not just core contracts [E1](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-16.md)
- Dutch-auction decay where the ask falls steeply over the window [E1](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-16.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-30.md)
- Settlement that checks `balanceOf(address(this))` against a decaying price instead of verifying the caller [E2](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-30.md)
- Public `safeTransferFrom`/settle entrypoints with no caller or marketplace check [E2](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-30.md)
- Epoch/deadline checks using a fixed `auctionWindow()` while the engine has anti-sniping extensions [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-31.md)
- L2 deployments with cheap block space and FCFS sequencing [E1](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-16.md)

## How to review
Find every place the code reasons about auction end time or settlement eligibility, then compare it to the auction engine's actual rules. The invariant: the end time and settlement authority the caller assumes must equal the engine's worst-case behavior (including extensions), and settlement must require proof the caller is the intended payer, not merely that funds are present. For config, check deployed immutables against realistic block-time and gas costs on the target chain.

## Variants seen
- Block-stuffing to suppress bids through a short auction window, buying full collateral for near-zero CREDIT [E1](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-16.md)
- Dust transfer of the payment token to a settlement contract to trigger floor-price settlement, blocking the liquidator [E2](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-30.md)
- Epoch check ignoring auction extensions, so extended auctions settle in a later epoch without an accountant [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-31.md)

## Why fixes fail
E3 shows the router's check was written against `auctionWindow()` while the engine separately extends by up to a day; fixing one side without reconciling the other leaves the gap.

## Impact and severity
Outcomes ranged from term-wide slashing and near-zero CREDIT collateral purchase [E1](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-16.md) to blocked liquidations [E2](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-30.md) and underpaid withdrawers [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-31.md). Severity rises when the window is short, decay is steep, and the chain makes suppression cheap [E1](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-16.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-16.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-30.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-31.md