Bid Beasts

Summary —
BidBeastsNFTMarket incorrectly authorizes withdrawal of stored failed-transfer credits. The function withdrawAllFailedCredits(address _receiver) reads credit balance for _receiver but zeroes and pays out to msg.sender. This mismatch allows any caller to withdraw another address’s credited funds to themselves, while leaving the victim’s credit unchanged — enabling repeated theft (double‑spend).

Affected Contract(s)
BidBeastsNFTMarket (file: src/BidBeastsNFTMarketPlace.sol)

Root Cause
A logic bug in withdrawAllFailedCredits where the mapping key used to read the credit (_receiver) is not the same key used to reset or pay (msg.sender). This inconsistent key usage breaks authorization and results in misdirected payouts

}

Impact

The victim’s recorded credit is not decremented, enabling repeated theft of the same credit (double‑spend).

Funds are drained from the marketplace’s balance and misdirected to attackers.

Exploitable on‑chain with minimal prerequisites (only knowledge of a credited address).

Reproduction (high level)

Create a bidder contract that reverts when receiving Ether (so refunds fail and the marketplace records failedTransferCredits[victim]).

Have that contract place the first bid.

Outbid it with another account; the marketplace will attempt to refund the victim, the refund reverts, and the contract records failedTransferCredits[victim].

An attacker calls withdrawAllFailedCredits(victim) — the marketplace pays the attacker (msg.sender) the amount recorded for victim, and does not clear the victim’s credit.

POC

forge test --match-contract ExploitWithdrawCredits -vvv

Fix (recommended patch)
Replace the vulnerable function with the following implementation that allows only the credited address to withdraw its own credits and uses checks‑effects‑interactions:

to test it

}