Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Truncation bug in minimum bid increment calculation

raminidalf

Root + Impact

Description

  • Normal behavior: The required minimum next bid should be calculated exactly based on the configured percentage increase.

Issue: The required bid uses (previousBidAmount / 100) * (100 + X) which does integer division first and loses precision, possibly requiring a lower increase than intended.

// Root cause in the codebase with @> marks to highlight the relevant section
if (previousBidAmount == 0) {
...
} else {
// @> Division happens before multiplication — rounding down reduces requiredAmount
requiredAmount = (previousBidAmount / 100) * (100 + S_MIN_BID_INCREMENT_PERCENTAGE);
require(msg.value >= requiredAmount, "Bid not high enough");
...
}
​

Risk

Likelihood:

  • Occurs whenever there is a previous bid with a value that is not a multiple of 100 — common for arbitrary bid amounts.

  • Every subsequent bidding round may accept a smaller-than-intended increment.

Impact:

  • Attackers or bidders can outbid with amounts smaller than the configured minimum percentage, subverting auction economics.

  • May reduce seller revenue and break assumptions about minimum increments.

Proof of Concept

// Suppose previousBidAmount = 101 wei, S_MIN_BID_INCREMENT_PERCENTAGE = 5
// Computed requiredAmount in current code:
// (101 / 100) * 105 = 1 * 105 = 105
// Correct computation:
// (101 * 105) / 100 = 106 (expected)
​

Recommended Mitigation

@@
- requiredAmount = (previousBidAmount / 100) * (100 + S_MIN_BID_INCREMENT_PERCENTAGE);
+ // Multiply first to avoid integer division truncation
+ requiredAmount = (previousBidAmount * (100 + S_MIN_BID_INCREMENT_PERCENTAGE)) / 100;
​
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Integer Division Precision Loss

Integer division in requiredAmount truncates fractions, allowing bids slightly lower than intended.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.