BidBeastsNFTMarketPlace::placeBid auction time extension stacking bug make sniping attack

Description

The auction logic should promote fairness by establishing a clear deadline (e.g., 3 days) and only extending the auction if a bid arrives close to the end. An ideal anti-sniping mechanism would reset the timer to “current block.timestamp + extension duration,” ensuring the end time remains consistently aligned with the intended gap from the latest bid.

That said, the current implementation accumulates extra time additively whenever the condition triggers (auctionEnd += 15 minutes). Consequently, the auction could overrun the 3-day threshold by a wide margin if multiple bids keep rolling in near the deadline. This creates an exploit opportunity for attackers to deploy bots and indefinitely postpone the auction's closure.

Risk

Likelihood: High

• Reason 1: This triggers every single time a bid arrives within less than 15 minutes of the deadline, since the extension logic consistently activates.

• Reason 2: It's ripe for exploitation by trading bots that are scripted to fire off repeated bids right as the auction nears its close.

Impact: Medium

• Impact 1: Auctions might stretch well beyond the intended 3-day cap, throwing off the predictable schedules that sellers and buyers rely on.

• Impact 2: The platform could erode user confidence, as the auction mechanics fall short of the documented promise of an “exactly 3 days” timeframe.

Proof of Concept

This Foundry test demonstrates the auction could overrun the 3-day threshold

Recommended Mitigation

There's 2 option:

Keep anti-sniping extension

Fixed hard deadline