Malicious users can donate/leave dust amounts of collateral in contract during auctions to buy other collateral at very low prices
Auctions are only ended early if the amount of the token being auctioned drops to 0. This can be exploited via donation or leaving dust in the contract to malicious extend the auction and buy further liquidate collateral at heavily discounted prices.\\nInsuranceFund.sol#L184-L199\\n```\\nfunction buyCollateralFromAuction(address token, uint amount) override external {\\n    Auction memory auction = auctions[token];\\n    // validate auction\\n    require(_isAuctionOngoing(auction.startedAt, auction.expiryTime), "IF.no_ongoing_auction");\\n\\n    // transfer funds\\n    uint vusdToTransfer = _calcVusdAmountForAuction(auction, token, amount);\\n    address buyer = _msgSender();\\n    vusd.safeTransferFrom(buyer, address(this), vusdToTransfer);\\n    IERC20(token).safeTransfer(buyer, amount); // will revert if there wasn't enough amount as requested\\n\\n    // close auction if no collateral left\\n    if (IERC20(token).balanceOf(address(this)) == 0) { <- @audit-issue only cancels auction if balance = 0\\n        auctions[token].startedAt = 0;\\n    }\\n}\\n```\\n\\nWhen buying collateral from an auction, the auction is only closed if the balance of the token is 0. This can be exploited in a few ways to maliciously extend auctions and keep the timer (and price) decreasing. The first would be buy all but 1 wei of a token leaving it in the contract so the auction won't close. Since 1 wei isn't worth the gas costs to buy, there would be a negative incentive to buy the collateral, likely resulting in no on buying the final amount. A second approach would be to frontrun an buys with a single wei transfer with the same results.\\nNow that the auction has been extended any additional collateral added during the duration of the auction will start immediately well below the assets actual value. This allows malicious users to buy the asset for much cheaper, causing loss to the insurance fund.
Close the auction if there is less than a certain threshold of a token remaining after it has been bought:\\n```\\n    IERC20(token).safeTransfer(buyer, amount); // will revert if there wasn't enough amount as requested\\n\\n+   uint256 minRemainingBalance = 1 * 10 ** (IERC20(token).decimal() - 3);\\n\\n    // close auction if no collateral left\\n+   if (IERC20(token).balanceOf(address(this)) <= minRemainingBalance) {\\n        auctions[token].startedAt = 0;\\n    }\\n```\\n
Users can maliciously extend auctions and potentially get collateral for very cheap
```\\nfunction buyCollateralFromAuction(address token, uint amount) override external {\\n    Auction memory auction = auctions[token];\\n    // validate auction\\n    require(_isAuctionOngoing(auction.startedAt, auction.expiryTime), "IF.no_ongoing_auction");\\n\\n    // transfer funds\\n    uint vusdToTransfer = _calcVusdAmountForAuction(auction, token, amount);\\n    address buyer = _msgSender();\\n    vusd.safeTransferFrom(buyer, address(this), vusdToTransfer);\\n    IERC20(token).safeTransfer(buyer, amount); // will revert if there wasn't enough amount as requested\\n\\n    // close auction if no collateral left\\n    if (IERC20(token).balanceOf(address(this)) == 0) { <- @audit-issue only cancels auction if balance = 0\\n        auctions[token].startedAt = 0;\\n    }\\n}\\n```\\n