Submitted by antonttc, also found by 0x52
Witch.sol#L176
Witch.sol#L399
Might lead to systematic debt. Cause errors for liquidators to run normally.
In the function auction, there is an input validation around whether the to is address(0) or not. And if the auctioneerReward is set to an value > 0 (as default),  each liquidate call will call Join module to pay out to auctioneer with the following line:
This line will revert if auctioneer is set to address(0) on some tokens (revert on transferring to address(0) is a default behaviour of the OpenZeppelin template). So if someone start an auction with to = address(0), this auction becomes un-liquidatable.
A malicious user can run a bot to monitor his own vault, and if they got underwater and they dont have enough collateral to top up, they can immediately start an auction on their own vault and set actioneer to 0 to avoid actually being liquidated, which breaks the design of the system.
Add check while starting an auction:
alcueca (Yield) confirmed and commented:
PierrickGT (judge) commented:
