Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

False “AuctionSettled” event emission on bid (misleads indexers/bots)

0xrayaa

Root + Impact

  • Root: placeBid emits AuctionSettled even though no sale/settlement occurs at that point.

  • Impact: Off-chain indexers/analytics/bots can treat active auctions as settled, triggering incorrect accounting, alerts, or automated actions.

Description

  • An AuctionSettled event should only be emitted when the auction is actually finalized: NFT transferred to the winner and seller proceeds distributed (i.e., inside the settlement path).

  • During a regular bid, before any settlement, the code emits AuctionSettled. This contradicts the event’s semantics and can cause off-chain consumers to incorrectly mark auctions as closed.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
Listing storage listing = listings[tokenId];
address previousBidder = bids[tokenId].bidder;
uint256 previousBidAmount = bids[tokenId].amount;
​
require(listing.seller != msg.sender, "Seller cannot bid");
require(listing.auctionEnd == 0 || block.timestamp < listing.auctionEnd, "Auction ended");
​
// --- Buy Now Logic ---
// ...
​
require(msg.sender != previousBidder, "Already highest bidder");
emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // @> WRONG: settlement event on mere bid
​
// --- Regular Bidding Logic ---
// ...
}

Risk

Likelihood:

• Reason 1 // Every valid placeBid call (except buy-now early return) will emit a false settlement event.
• Reason 2 // Auctions typically receive multiple bids; the issue will repeat frequently across listings.

Impact:

  • Impact 1 // Indexers/analytics mark auctions as settled prematurely, corrupting marketplace stats and dashboards.

  • Impact 2 // Bots (e.g., settlement/notifier/hedging) may act on false signals, leading to operational or financial errors.


Recommended Mitigation

  • Remove the incorrect emission from placeBid.

  • Emit AuctionSettled only in _executeSale, where the NFT transfer and payouts actually occur.

Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!