Root + Impact

Description

The intended behavior:

1. Takes the previous bid amount

1. Calculates a 5% increase (using S_MIN_BID_INCREMENT_PERCENTAGE = 5)

1. Requires new bid to be at least this increased amount

1. Prevents small bid increments and ensures meaningful price discovery

Vulnerability:

The BidBeastsNFTMarket contract contains a precision loss vulnerability in its bid increment calculation. The current implementation performs division before multiplication, leading to truncation of values due to Solidity's integer arithmetic. This allows users to place bids lower than the intended minimum increment amount.

Risk

• Bidders can place bids lower than intended minimum increment

• Protocol receives less in bid increments than designed

• Compounds with each bid, leading to accumulated value loss

• Sellers receive less value than protocol design intended

  
  

Likelihood:

• Medium - Allows bids below intended minimum increment

Impact:

• High - Occurs with most bid amounts not divisible by 100

Proof of Concept

The above PoC demonstrates that:

1. A bid of 1050 wei is accepted when it should require 1055 wei

1. This represents a 5 wei loss in the minimum increment

1. The issue compounds with larger numbers and subsequent bids

1. Affects any bid amount not perfectly divisible by 100

Recommended Mitigation

These changes ensure:

1. No precision loss in bid calculations

1. Consistent and accurate minimum bid requirements

1. Better maintainability and clarity of code

1. Proper test coverage for edge cases