Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Dangerous require statement prevents any user from placing a bid 15 minutes after the first bidder places a bid.

ntdegenerate

Root + Impact

Dangerous require statement in BidBeastsNFTMarket:placeBid prevents any user from placing a bid 15 minutes after the first bidder places a bid.

Description

When a seller lists an NFT, the Listing.auctionEnd is set to 0 until a first bidder places a bid on the nft, and if the bid places is less thank the Listing.buyNowPrice, the Bid struct is updated with the current bid, and Listing.auctionEnd is set to 15 minutes i.e S_AUCTION_EXTENSION_DURATION. However, because of the below require statement, any user that attempts to bid after the first 15 minutes has passed is blocked from making a bid.

require(listing.auctionEnd == 0 || block.timestamp < listing.auctionEnd, "Auction ended");

This Implies that only the first bidder will be acknowledged and will be sold the NFT

@> https://github.com/CodeHawks-Contests/2025-09-bid-beasts/blob/449341c55a57d3f078d1250051a7b34625d3aa04/src/BidBeastsNFTMarketPlace.sol#L115

Risk

Likelihood:

  • Reason 1: This happens if no other user place a bid on the NFT, 15 minutes after the auction starts.

Impact:

  • Severe disruption of functionality as it prevents users from placing a bid

  • Potential loss of funds as only first bid is acknowledged and users are prevented from placing a higher bid.

Proof of Concept

  • A user places a bid on an NFT and starts the auction

  • Another user tries to place a bid after the first 15 minutes, but is blocked from bidding.

function testCanPlaceBidAfterTimeIncrement() public warmMarket {
vm.prank(BIDDER_1);
market.placeBid{value: MIN_PRICE + 0.5 ether}(TOKEN_ID);
vm.warp(block.timestamp + market.S_AUCTION_EXTENSION_DURATION() + 1);
vm.prank(BIDDER_2);
vm.expectRevert("Auction ended");
market.placeBid{value: MIN_PRICE + 1 ether}(TOKEN_ID);
}

Recommended Mitigation

  • Set the Listing.auctionEnd to 3 days after the first bid is placed outlined by the docs.
    In BidBeastsNFTMarket:placeBid

if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
- listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
- emit AuctionExtended(tokenId, listing.auctionEnd);
+ listing.auctionEnd = block.timestamp + 3days;
+ emit AuctionRemainingTime(tokenId, listing.auctionEnd);
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Appeal created

ntdegenerate Submitter
2 months ago
cryptoghost Lead Judge
2 months ago
cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!