Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Auction Duration Configuration

eagerpanda582

Root + Impact

Description

  • The intended behavior of the auction system is that once a valid bid is placed, the auction should run for a total of 3 days before anyone can settle or finalize it.

  • However, in the current implementation, the auctionEnd time is set using a constant S_AUCTION_EXTENSION_DURATION = 15 minutes, which incorrectly limits the entire auction duration to just 15 minutes after the first bid.

  • Also if in the 15 minif no one bids then the auction can be bidded by anyone.

uint256 constant public S_AUCTION_EXTENSION_DURATION = 15 minutes;

Risk

Likelihood: HIGH

  • Every auction created in this system will close just 15 minutes after the first valid bid is placed.

  • This will consistently occur across all NFTs listed, impacting every auction flow.

Impact: HIGH

  • Auctions may end before legitimate users have time to place competing bids.

  • It violates the business logic and user expectation of a 3-day bidding window, which could result in seller losses and legal/compliance risks.

Proof of Concept

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;
​
import {Test, console} from "forge-std/Test.sol";
import {BidBeastsNFTMarket} from "../src/BidBeastsNFTMarketPlace.sol";
import {BidBeasts} from "../src/BidBeasts_NFT_ERC721.sol";
​
// A mock contract that cannot receive Ether, to test the payout failure logic.
contract RejectEther {
// Intentionally has no payable receive or fallback
}
​
contract BidBeastsNFTMarketTest is Test {
// --- State Variables ---
BidBeastsNFTMarket market;
BidBeasts nft;
RejectEther rejector;
​
// --- Users ---
address public constant OWNER = address(0x1); // Contract deployer/owner
address public constant SELLER = address(0x2);
address public constant BIDDER_1 = address(0x3);
address public constant BIDDER_2 = address(0x4);
​
// --- Constants ---
uint256 public constant STARTING_BALANCE = 100 ether;
uint256 public constant TOKEN_ID = 0;
uint256 public constant MIN_PRICE = 1 ether;
uint256 public constant BUY_NOW_PRICE = 0;
​
function setUp() public {
// Deploy contracts
vm.prank(OWNER);
nft = new BidBeasts();
market = new BidBeastsNFTMarket(address(nft));
rejector = new RejectEther();
​
vm.stopPrank();
​
// Fund users
vm.deal(SELLER, STARTING_BALANCE);
vm.deal(BIDDER_1, STARTING_BALANCE);
vm.deal(BIDDER_2, STARTING_BALANCE);
}
​
// --- Helper function to list an NFT ---
function _listNFT() internal {
vm.startPrank(SELLER);
nft.approve(address(market), TOKEN_ID);
market.listNFT(TOKEN_ID, MIN_PRICE, BUY_NOW_PRICE);
vm.stopPrank();
}
​
// -- Helper function to mint an NFT ---
function _mintNFT() internal {
vm.startPrank(OWNER);
nft.mint(SELLER);
vm.stopPrank();
}
​
/*//////////////////////////////////////////////////////////////
LISTING TESTS
//////////////////////////////////////////////////////////////*/
​
function testAuctionEndsTooEarly() public {
_mintNFT();
_listNFT();
​
vm.prank(BIDDER_1);
market.placeBid{value: 1.1 ether}(TOKEN_ID);
​
// Simulate waiting for 16 minutes
vm.warp(block.timestamp + 16 minutes);
​
// This will now pass due to 15-minute auction window
vm.prank(BIDDER_2);
vm.expectRevert("Auction ended");
market.placeBid{value: 2 ether}(TOKEN_ID);
}
​
}
​

Recommended Mitigation

Changing it to 03 days will solve the issue.

- uint256 constant public S_AUCTION_EXTENSION_DURATION = 15 minutes;
+ uint256 constant public S_AUCTION_EXTENSION_DURATION = 3 days;
​
//also remove this code because if the new bids comes in the duration exceeds the 3 day limit .
​
- uint256 timeLeft = 0;
- if (listing.auctionEnd > block.timestamp) {
- timeLeft = listing.auctionEnd - block.timestamp;
- }
- if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
- listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
- emit AuctionExtended(tokenId, listing.auctionEnd);
- }
Updates

Lead Judging Commences

cryptoghost Lead Judge
2 months ago
cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!