Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Wrong Event Emission in `BidBeastsNFTMarket:placeBid` give wrong information about auction state

ntdegenerate

Root + Impact

Wrong Event Emission in BidBeastsNFTMarket:placeBid give wrong information about auction state

Description

  • In BidBeastsNFTMarket:placeBid, whenever a user places a bid on an NFT below the buyNowPrice, the AuctionSettled event is emitted signifying that the nft has sold to the current bidder and that seller has been settled. However, this is mis-information as other users can still place bids on the same NFT.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
.
.
.
emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
.
.
.
}
https://github.com/CodeHawks-Contests/2025-09-bid-beasts/blob/449341c55a57d3f078d1250051a7b34625d3aa04/src/BidBeastsNFTMarketPlace.sol#L143

Risk

Likelihood:

  • Reason 1: This occurs anytime a bid is placed below the buyNowPrice

Impact:

  • Causes wrong information to be displayed on the front end

  • Brings about confusion on the state of the auction

  • Can trigger wrong actions by indexers that rely on these events.

Proof of Concept

Place the following code in BidBeastsNFTMarketTest.t.sol

event AuctionSettled(uint256 tokenId, address winner, address seller, uint256 price);
​
function testWrongEventEmissionInPlaceBid() public {
_mintNFT();
_listNFT();
​
vm.startPrank(BIDDER_1);
vm.expectEmit(address(market));
emit AuctionSettled(TOKEN_ID, BIDDER_1, SELLER, MIN_PRICE * 2);
market.placeBid{value: MIN_PRICE * 2}(TOKEN_ID);
vm.stopPrank();
}

Recommended Mitigation

  • Remove the following line from the code.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
.
.
.
- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
.
.
.
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!