Bid Beasts

First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Severity: low
Valid

Documentation / Implementation Mismatch: listNFT Parameter Inconsistency

Root + Impact

Description

The documentation specifies that listNFT accepts only two parameters (tokenId, minPrice).
However, the actual implementation requires three parameters (tokenId, _minPrice, _buyNowPrice).

This inconsistency between code and documentation can lead to failed integration attempts and confusion. Developers following documentation will not provide the _buyNowPrice parameter, resulting in compilation or runtime errors.

// Root cause in the codebase
// Documentation states: listNFT(tokenId, minPrice)
// Code implementation provides:
@> function listNFT(uint256 tokenId, uint256 _minPrice, uint256 _buyNowPrice) external { ... }

Risk

Likelihood:

  • Occurs whenever developers, auditors, or frontend engineers follow the documentation and attempt to list an NFT with two arguments.

  • Almost guaranteed since documentation is the primary reference.

Impact:

  • Integration and testing failures due to mismatched function signatures.

  • Delayed development and incorrect assumptions about auction functionality.

Proof of Concept

According to documentation:

// Expected call
market.listNFT(TOKEN_ID, MIN_PRICE);

But actual code requires:

// Correct call
market.listNFT(TOKEN_ID, MIN_PRICE, BUY_NOW_PRICE);

Recommended Mitigation

Either update documentation or modify the function signature to align.

- NFT owners call listNFT(tokenId, minPrice) to list their token.
+ NFT owners call listNFT(tokenId, minPrice, buyNowPrice) to list their token.
+ If buyNowPrice = 0, the NFT will only be sold through auction.
Updates

Lead Judging Commences

cryptoghost Lead Judge
2 months ago
cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!