Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect bid amount emitted in `NewHighestBid` event in the `bid` function.

v1vah0us3

Vulnerability Details:

In the bid function, the NewHighestBid event emits an incorrect bid amount. Specifically, the event emits the previous highest bid instead of the current bid amount:

............
@> self.emit(NewHighestBid {amount: self.highest_bid.read(), sender: sender});
self.highest_bidder.write(sender);
@> self.highest_bid.write(amount);

The self.highest_bid.read() function reads the highest bid before it is updated with the new bid amount. This means the amount emitted in the NewHighestBid event in the bid function refers to the previous highest bid, not the bid just placed by the user.

Impact:

This issue is low severity because it does not affect the functionality of the auction, nor does it result in any loss of funds or security risks. However, it impacts the accuracy of emitted events, which are critical for external systems or users monitoring contract activity.

Tools Used

Manual Code Review, VSCode

Recommendations:

To ensure that the correct bid amount is emitted in the NewHighestBid event, the event should be emitted after the highest_bid is updated with the new bid amount in the bid function.
Consider moving the event emission after the bid amount is updated in bid:

fn bid(ref self: ContractState, amount: u64) {
let time = get_block_timestamp();
let erc20_dispatcher = IERC20Dispatcher { contract_address: self.erc20_token.read() };
let sender = get_caller_address();
let receiver = get_contract_address();
let current_bid = self.highest_bid.read();
assert(self.started.read(), 'Auction is not started');
assert(time < self.bidding_end.read(), 'Auction ended');
assert(amount > current_bid, 'The bid is not sufficient');
self.bid_values.entry(sender).write(amount);
- self.emit(NewHighestBid {amount: self.highest_bid.read(), sender: sender});
self.highest_bidder.write(sender);
self.highest_bid.write(amount);
+ self.emit(NewHighestBid {amount: self.highest_bid.read(), sender: sender});
erc20_dispatcher.transfer(receiver, amount.into());
}
Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrectly emitted parameter in `NewHighestBid` event

The `bid` function emits `NewHighestBid` event with wrong parameter. The `amount` parameter is `self.highest_bid.read()` that is called before the update of the `highest_bid` variable.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.