Submission Details
Severity:
M-01: Missing `endAuction()` function as intented in contest details
Summary
As stated in the contest details, the contract is missing endAuction() function that allows anyone to call and finalize the auction after 3 days. The current implementation is:
Seller can unlist NFT at anytime if no bids have been placed
Auction ends 15mins after a bid is placed (instead of 3days) and anyone can settle/end the auction.
Vulnerability Details
## The flow is simple:
1. **Listing**:
* NFT owners call `listNFT(tokenId, minPrice)` to list their token.
* The NFT is transferred from the seller to the marketplace contract.
2. **Bidding**:
* Users call `placeBid(tokenId)` and send ETH to place a bid.
* New bids must be higher than the previous bid.
* Previous bidders are refunded automatically.
3. **Auction Completion**:
+ * After 3 days, anyone can call `endAuction(tokenId)` to finalize the auction.
* If the highest bid meets or exceeds the minimum price:
* NFT is transferred to the winning bidder.
* Seller receives payment minus a 5% marketplace fee.
* If no valid bids were made:
* NFT is returned to the original seller.
4. **Fee Withdrawal**:
* Contract owner can withdraw accumulated fees using `withdrawFee()`.
Impact/Proof of Concept
1. Auction can end before 3 days, if a bid has been placed.
2. Seller can choose to unlist NFT anytime if no bids has been placed.
Recommendations
Add endAuction() function that allows anyone to call and end the auction after 3 days.
Updates
Lead Judging Commences
cryptoghost 2 months ago
Submission Judgement Published Assigned finding tags:
BidBeasts Marketplace: Improper Documentation
Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.