Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

The `AuctionSettled` event in `BidBeastsNFTMarketPlace::placeBid` fires prematurely, causing protocol confusion.

mustby

The AuctionSettled event in BidBeastsNFTMarketPlace::placeBid fires prematurely, causing protocol confusion.

Description: Inside the BidBeastsNFTMarketPlace::placeBid function, we can see the AuctionSettled event being called between the Buy it now and regular bidding logic:

// Buy now logic up here
.
.
.
require(msg.sender != previousBidder, "Already highest bidder");
@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
.
.
.
// Regular bidding logic below

Risk:

IMPACT: Low

  • While funds aren't at risk, this event firing on every bid placed will cause great confusion within the protocol. This error will mislead off-chain systems/frontends.

LIKELIHOOD: High

  • This will happen on every regular bid (but should NOT be happening when the auction is still live!).

Proof of Concept:

  1. Mint and list an NFT (TOKEN_ID = 0, MIN_PRICE = 1 ether, BUY_NOW_PRICE = 5 ether).

  2. Place a bid of 2 ether (below BUY_NOW_PRICE) as BIDDER_1.

  3. Check logs for AuctionSettled event (emitted incorrectly) and BidPlaced event (expected).

  4. Verify auction is still active (listing.listed == true, NFT in market).

Recommended Mitigation: Remove the code from the function:

// Buy now logic up here
.
.
.
require(msg.sender != previousBidder, "Already highest bidder");
- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
.
.
.
// Regular bidding logic below

We do not need to do anything else because the _executeSale function already triggers this event.

Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!