Root + Impact

Description

• Normally, a new bid must be at least greater than the previous bid by a minimum increment (e.g., 5%) to ensure the auction progresses fairly.

• In the current implementation, the calculation of requiredAmount performs integer division first and then multiplies, truncating decimals. This leads to underestimation of the required increment, and in some cases may even result in the required bid being lower than the previous bid.

Risk

Likelihood:

• This will occur whenever the bid amount is not an exact multiple of 100.

• It is particularly problematic in low-value auctions or odd amounts such as 101 wei or 999 wei.

Impact:

• Lower bid threshold — Attackers or users may exploit truncation to place bids with less than the intended increment, bypassing fair bidding logic.

• Distorted auction outcome — The final settlement price may be lower than fair market value, directly causing economic loss for sellers.

Proof of Concept

Example: Current highest bid = 101 wei, minimum increment = 5%.

• Expected correct calculation: At least 106 wei is required (+5%).

• Current implementation: (101 / 100) * 105 = 105, allowing only 105 wei, which is below the intended threshold.

Recommended Mitigation

Fix the calculation by using multiply first, then divide with ceiling to prevent truncation and guarantee the minimum increment is always met: