Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

First Bid Must Strictly Exceed Minimum Price

ambitiousdydx

Description

  • When no bids have been placed on a listed NFT, the first bid should be accepted if it meets or exceeds the minimum price set by the seller, allowing auctions to start at the intended reserve level and encouraging participation.

  • The validation for the first bid incorrectly uses a strict greater-than (>) comparison instead of greater-than-or-equal (>=), which rejects bids exactly matching the minPrice, forcing bidders to overpay unnecessarily and creating inconsistency with other checks like subsequent bid increments or buy-now prices that allow equality.

if (previousBidAmount == 0) {
​
requiredAmount = listing.minPrice;
@> require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
​
}

Risk

Likelihood:

  • Sellers set a precise minPrice expecting bids to begin exactly at that amount

  • Potential first bidders submit exactly the minPrice, which is a natural choice for starting auctions

Impact:

  • Auctions fail to attract initial bids, leading to fewer successful sales and reduced platform activity

  • Frustration for users and potential loss of revenue for sellers who must relist with adjusted prices

Proof of Concept

Add the following test function into the existing tests in BidBeastsMarketPlaceTest.t.sol

function test_FirstBidExactMinReverts() public {
// Step 1: Mint and list an NFT with MIN_PRICE
_mintNFT();
_listNFT();
​
// Verify listing is active
assertTrue(market.getListing(TOKEN_ID).listed, "NFT should be listed");
​
// Step 2: Attempt first bid exactly at MIN_PRICE
vm.prank(BIDDER_1);
vm.expectRevert("First bid must be > min price");
market.placeBid{value: MIN_PRICE}(TOKEN_ID);
​
// Step 3: Verify no bid was placed
BidBeastsNFTMarket.Bid memory highestBid = market.getHighestBid(TOKEN_ID);
assertEq(highestBid.amount, 0, "No bid should be recorded");
​
// Step 4: Confirm bid slightly above succeeds (for contrast)
vm.prank(BIDDER_1);
market.placeBid{value: MIN_PRICE + 1 wei}(TOKEN_ID);
highestBid = market.getHighestBid(TOKEN_ID);
assertEq(highestBid.amount, MIN_PRICE + 1 wei, "Higher bid should succeed");
}

Recommended Mitigation

Update the comparison to >= to allow exact matches, and adjust the error message for clarity. This ensures consistency across bidding logic and aligns with user expectations for minimum prices.

if (previousBidAmount == 0) {
​
requiredAmount = listing.minPrice;
- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value >= requiredAmount, "First bid must be at least min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
​
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: First Bid > Instead of >=

First bid validation uses > instead of >=, preventing valid starting bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!