In auction.sol (and potentially other files), is there a reason why functions like setup(), addToWhitelist() etc are public instead of external? They are not being called internally, so external visibility is sufficient.
https://github.com/ConsenSys/smart-contract-best-practices#explicitly-mark-visibility-in-functions-and-state-variables