Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Division Precision Loss in PlaceBid

duma999

Division Precision Loss in PlaceBid

Description

When a new bidder calls the function PlaceBid, the function will check if the bidding amount is bigger than the previous bidding. but on top of that, the protocol adds a 5% incremental percentage; this means the next bidder will need to have a bid amount higher than previousBid + 5%. It calculates in the following line:

requiredAmount = (previousBidAmount / 100) * (100 + S_MIN_BID_INCREMENT_PERCENTAGE);
require(msg.value >= requiredAmount, "Bid not high enough");

Solidity use Fixed Point Arithmetic, that mean it doesn't support decimal value.
As a result, any non-integer value is truncated downward.

Risk

This characteristic of Solidity can lead to precision loss during numerical operations, especially when division is performed before multiplication, adversely affecting the accuracy of calculations. (https://lab.guardianaudits.com/encyclopedia-of-common-solidity-bugs/division-precision-loss)

Recommended Mitigation

The recommended approach is to perform the multiplication before the division :

- requiredAmount = (previousBidAmount / 100) * (100 + S_MIN_BID_INCREMENT_PERCENTAGE);
+ requiredAmount = (previousBidAmount * 100) / (100 + S_MIN_BID_INCREMENT_PERCENTAGE);
require(msg.value >= requiredAmount, "Bid not high enough");
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeast Marketplace: Unrestricted FailedCredits Withdrawal

withdrawAllFailedCredits allows any user to withdraw another account’s failed transfer credits due to improper use of msg.sender instead of _receiver for balance reset and transfer.

Appeal created

duma999 Submitter
2 months ago
cryptoghost Lead Judge
2 months ago
cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Integer Division Precision Loss

Integer division in requiredAmount truncates fractions, allowing bids slightly lower than intended.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!