Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[M-1]AuctionSettled event was mistakenly emitted in placeBid.

bababoyi

Root + Impact

Description

  • Under normal behavior, the AuctionSettled event should only be emitted when the auction is finalized (e.g., in _executeSale after transferring funds and NFT).

  • In the current implementation, placeBid (normal bidding flow) incorrectly emits AuctionSettled, which generates settlement logs on every bid, misleading frontends, monitoring, and auditing systems into thinking the auction has already concluded.

// Root cause in the codebase with @> marks to highlight the relevant section
function placeBid(uint256 tokenId) external payable {
...
require(msg.sender != previousBidder, "Already highest bidder");
@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // ❌ Wrong location
...
}

Risk

Likelihood:

  • This issue occurs every time a user places a bid, since placeBid consistently triggers the incorrect event emission.

  • As a result, a single auction may generate multiple fake AuctionSettled logs.

Impact:

  • Log pollution — Event indexers (e.g., The Graph, Dune, frontend subscriptions) will receive incorrect settlement events, leading to inconsistent data.

  • Monitoring and security analysis disruption — Auditors, on-chain monitoring tools, and compliance systems may be misled into believing that the auction has settled prematurely

Proof of Concept

The following example demonstrates that when a user places a bid, the contract incorrectly emits the AuctionSettled event. Although the auction is still ongoing, the logs misleadingly indicate it has already settled, causing frontends or on-chain indexers to show incorrect states.

// User A lists NFT at 1 ETH
market.listNFT(tokenId, 1 ether);
​
// User B bids 1.1 ETH
market.placeBid{value: 1.1 ether}(tokenId);
​
// ❌ Event AuctionSettled is emitted here
// Logs show auction as "settled" even though it is still ongoing.
​

Recommended Mitigation

Remove the incorrect AuctionSettled emission from placeBid and keep the event emission inside _executeSale as the only valid settlement trigger. This ensures that the event semantics match the actual logic, preventing log pollution and misinterpretation.

function placeBid(uint256 tokenId) external payable {
...
- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
...
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!