Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Emission of misleading event

r4ck3

Emitting a misleading event

Description

  • The AuctionSettled event is emitted but the auction has actually not been settled.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
Listing storage listing = listings[tokenId];
address previousBidder = bids[tokenId].bidder;
uint256 previousBidAmount = bids[tokenId].amount;
.
.
.
require(msg.sender != previousBidder, "Already highest bidder");
@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
​
// --- Regular Bidding Logic ---
uint256 requiredAmount;
.
.
.

Risk

Likelihood:

  • This happens when user calls placeBid function but sends less eth than the buyNowPrice so the buy now logic gets skipped

Impact:

  • AuctionSettled event gets emitted but the auction has not been settled yet.

Proof of Concept

Owner of the nft creates a listing of the nft in the marketplace.

Bidder bids certain amount of eth to that listing using placeBid function.

Problem appears in these 2 cases:

  • The msg.value has to be less than buyNowPrice

  • If in the listing buyNowPrice, was set to 0 it indicates that buy now logic will always be skipped for that listing.

AuctionSettled event gets emitted but the auction has not yet been settled.

Recommended Mitigation

Deleting the line where the event gets emitted will fix this problem and the rest of the logic would work just fine without it.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
Listing storage listing = listings[tokenId];
address previousBidder = bids[tokenId].bidder;
uint256 previousBidAmount = bids[tokenId].amount;
.
.
.
require(msg.sender != previousBidder, "Already highest bidder");
- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
​
// --- Regular Bidding Logic ---
uint256 requiredAmount;
.
.
.
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!