Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

First Bid Must Exceed Minimum Price Instead of Meeting It

pxlvre

Low: First Bid Must Exceed Minimum Price Instead of Meeting It

Description

  • The auction system sets a minimum price that sellers expect to receive for their NFT to ensure fair value.

  • The first bid validation requires the bid to be strictly greater than the minimum price rather than greater than or equal to it, preventing bids at exactly the minimum price.

if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price"); // @> Should be >= not >

Risk

Likelihood:

  • Occurs when bidders attempt to bid exactly the minimum price

  • Happens when users trust the UI showing minimum price as acceptable

Impact:

  • User confusion when minimum price bids are rejected

  • Sellers cannot receive bids at their stated minimum price

  • Inconsistent with standard auction behavior

Proof of Concept

This test shows how the current implementation incorrectly rejects bids at exactly the minimum price, forcing bidders to pay more than the seller's stated minimum.

function test_FirstBidMustExceedMinPrice() public {
_mintNFT();
// Seller lists with 1 ETH minimum
vm.startPrank(SELLER);
nft.approve(address(market), TOKEN_ID);
market.listNFT(TOKEN_ID, 1 ether, 5 ether); // min: 1 ETH, buyNow: 5 ETH
vm.stopPrank();
// Bidder attempts to bid exactly the minimum price
vm.prank(BIDDER_1);
vm.expectRevert("First bid must be > min price");
market.placeBid{value: 1 ether}(TOKEN_ID); // Fails!
// Must bid MORE than minimum to succeed
vm.prank(BIDDER_1);
market.placeBid{value: 1 ether + 1 wei}(TOKEN_ID); // Works
// This contradicts the concept of "minimum" price
// Sellers expect to potentially receive their minimum price
// Bidders expect minimum price to be acceptable
}

Recommended Mitigation

Change the comparison operator to allow bids at exactly the minimum price. This aligns with standard auction behavior and user expectations.

if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value >= requiredAmount, "First bid must meet min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}

This change:

  • Allows bidders to bid exactly the minimum price as the first bid

  • Aligns with the semantic meaning of "minimum price"

  • Matches user expectations from both seller and bidder perspectives

  • Maintains consistency with standard auction platforms

Updates

Lead Judging Commences

cryptoghost Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: First Bid > Instead of >=

First bid validation uses > instead of >=, preventing valid starting bids.

cryptoghost Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: First Bid > Instead of >=

First bid validation uses > instead of >=, preventing valid starting bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.