Submission Details
Severity:
minPrice not taken into account when bidding
minPrice not taken into account when bidding
Description
The competition's description explained that
If the highest bid meets or exceeds the minimum price:
* NFT is transferred to the winning bidder.
* Seller receives payment minus a 5% marketplace fee.
But the function placeBid as strict inequation stalement :
function placeBid(uint256 tokenId) external payable isListed(tokenId) {
...
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
...
}
Risk
impact(low) : The Minimum price enforcement is properly implement, if the bid meets the minimum price ass the description said, it will not pass.
likelyhood(Medium) : It is likely to append at the beginning of the auction, not every time though.
Proof of Concept
Add this test to BidBeastsMarketPlaceTest.t.sol
function test_FirstBid_with_min_price_revert() public {
_mintNFT();
_listNFT();
vm.prank(BIDDER_1);
vm.expectRevert("First bid must be > min price");
market.placeBid{value: MIN_PRICE}(TOKEN_ID);
}
Recommended Mitigation
Change the stalement form > to >= in the placeBid function :
function placeBid(uint256 tokenId) external payable isListed(tokenId) {
...
requiredAmount = listing.minPrice;
- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value >= requiredAmount, "First bid must be >= min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
...
}
Updates
Lead Judging Commences
cryptoghost 2 months ago
Submission Judgement Published Assigned finding tags:
BidBeasts Marketplace: First Bid > Instead of >=
First bid validation uses > instead of >=, preventing valid starting bids.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.