Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect event emission in bid function

abhishekthakur

Summary

The NewHighestBid event is emitted with the old highest bid amount instead of the new one.

Vulnerability Details

https://github.com/Cyfrin/2024-10-starknet-auction/blob/main/src/starknet_auction.cairo#L109

The NewHighestBid event is emitted before the highest_bid state is updated. This occurs in the following order:

self.emit(NewHighestBid {amount: self.highest_bid.read(), sender: sender});
self.highest_bidder.write(sender);
self.highest_bid.write(amount);

As a result, the event data contains the old highest bid amount instead of the new one.

Impact

Off chain system can be affected due to wrong data emission.

Tools Used

Manual Review

Recommendations

Update the contract to emit the NewHighestBid event after updating the highest_bid state variable.

Updates

Lead Judging Commences

bube Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrectly emitted parameter in `NewHighestBid` event

The `bid` function emits `NewHighestBid` event with wrong parameter. The `amount` parameter is `self.highest_bid.read()` that is called before the update of the `highest_bid` variable.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.