Submission Details
Severity:
Auction Duration Mismatch: 15 Minutes Instead of Documented 3 Days
Root + Impact
Description
-
The README documentation states auctions last "exactly 3 days", but the actual implementation creates auctions that end after only 15 minutes.
-
the actual implementation uses:
uint256 constant public S_AUCTION_EXTENSION_DURATION = 15 minutes;
// When first bid is placed:
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION; //@audit Only 15 minutes!
Risk
Impact:
-
Integration Failures: Systems built expecting 3-day auctions will malfunction
-
Competitive Bidding Loss: Insufficient time for proper price discovery
Proof of Concept
function test_auctionDuration_DoesNotLast3Days() public {
_mintNFT();
_listNFT();
uint256 testStartTime = block.timestamp;
// Place first bid to start auction timer
uint256 firstBidAmount = MIN_PRICE + 0.1 ether;
vm.prank(BIDDER_1);
market.placeBid{value: firstBidAmount}(TOKEN_ID);
// Get auction end time
BidBeastsNFTMarket.Listing memory listing = market.getListing(TOKEN_ID);
uint256 auctionEnd = listing.auctionEnd;
// PROOF: Auction ends in 15 minutes, not 3 days
uint256 expectedEnd15Minutes = testStartTime + 15 minutes;
uint256 expectedEnd3Days = testStartTime + 3 days;
assertEq(auctionEnd, expectedEnd15Minutes, "Auction should end in 15 minutes");
assertTrue(auctionEnd != expectedEnd3Days, "Auction should NOT end in 3 days");
// PROOF: Can settle after 15 minutes
vm.warp(auctionEnd + 1);
vm.prank(BIDDER_2);
market.settleAuction(TOKEN_ID); // This succeeds!
// PROOF: Duration calculations
uint256 actualDuration = auctionEnd - testStartTime;
uint256 documentedDuration = 3 days;
assertEq(actualDuration, 15 minutes, "Actual duration should be 15 minutes");
}
Recommended Mitigation
Add Initial 3-Day Duration.
+ uint256 constant public S_INITIAL_AUCTION_DURATION = 3 days;
Updates
Lead Judging Commences
cryptoghost 2 months ago
Submission Judgement Published Assigned finding tags:
BidBeasts Marketplace: Improper Documentation
Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.