Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Flawed Auction Extension Logic Can Lead to Unintended Durations

folijr01

Root + Impact

Description

  • The anti-sniping logic in the placeBid function is implemented incorrectly. When a last-minute bid extends the auction, the code adds the extension duration to the

    previous auctionEnd time (listing.auctionEnd + S_AUCTION_EXTENSION_DURATION). The correct implementation is to set the new end time relative to the current block's timestamp (

    block.timestamp + S_AUCTION_EXTENSION_DURATION). This flaw causes the remaining time to be added to the extension, making auctions last significantly longer than the intended 15 minutes.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • This occurs every time a bid is placed when the time left in the auction is less than S_AUCTION_EXTENSION_DURATION.

  • A user places a bid moments before the auction is scheduled to end.

Impact:

  • The auction's core timing mechanism is broken and unpredictable, violating the principle of least surprise for all participants.

  • This can disrupt fair price discovery by giving bidders an unfairly long and inconsistent time window to react.

Proof of Concept

if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}

Recommended Mitigation

- listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
+ listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeast Marketplace: Auction Duration Miscalculation

BidBeast marketplace contains a flaw in its auction timing mechanism. This causes the contract to miscalculate the actual end time of an auction, resulting in auctions that either conclude prematurely or run longer than specified.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!