Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[M-2]Incorrect initial auction duration: 15 minutes in code vs 3 days in README

bababoyi

Root + Impact

Description

  • Normally, an NFT auction should have a clear initial duration (e.g., 3 days), and near the end of the auction, an extension mechanism (e.g., +15 minutes) can be applied to prevent last-second sniping.

  • In the current implementation, the contract only defines S_AUCTION_EXTENSION_DURATION = 15 minutes and directly applies it when setting auctionEnd after the first bid. This means the auction lasts only 15 minutes instead of the 3 days stated in the documentation/README, leading to inconsistent behavior and logical confusion.

// Root cause in the codebase with @> marks to highlight the relevant section
// in placeBid()
if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
@> listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION; // ❌ wrong: should be full duration, not extension
emit AuctionExtended(tokenId, listing.auctionEnd);
}

Risk

Likelihood:

  • This will always occur when any auction receives its first bid.

  • The issue affects every auction’s lifecycle.

Impact:

  • User experience mismatch — Users expect a 3-day auction, but auctions only last 15 minutes.

  • Security risk — Short auctions are vulnerable to sniping or manipulation, undermining fairness.

Proof of Concept

After deployment, a seller lists an NFT for auction.
When the first bid is placed, listing.auctionEnd is set to block.timestamp + 15 minutes.
Even if the frontend shows a 3-day auction, the on-chain logic ends it in 15 minutes.

// Setup: first bid on listed NFT
// Expected: auctionEnd = now + 3 days
// Actual: auctionEnd = now + 15 minutes

Recommended Mitigation

Introduce a separate initial auction duration constant (S_AUCTION_DURATION = 3 days) for first bids, while keeping S_AUCTION_EXTENSION_DURATION = 15 minutes for extensions near the end.

- uint256 constant public S_AUCTION_EXTENSION_DURATION = 15 minutes;
+ uint256 constant public S_AUCTION_DURATION = 3 days;
+ uint256 constant public S_AUCTION_EXTENSION_DURATION = 15 minutes;
​
if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
- listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
+ listing.auctionEnd = block.timestamp + S_AUCTION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!