Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

Public Unlisting Function Violates Auction Immutability Principle

iamkashifyousuf

Description

Normal Behavior

Once an auction starts, it should run for its full duration unless ended through proper bidding processes and the participants should have confidence their bids are secure and won't be invalidated arbitrarily

Issue

The unListNft() function is marked as external which is publicly accessible and allows sellers to cancel auctions at any time.

@> function unlistNFT(uint256 tokenId) external isListed(tokenId) isSeller(tokenId, msg.sender) {
require(bids[tokenId].bidder == address(0), "Cannot unlist, a bid has been placed");
​
Listing storage listing = listings[tokenId];
listing.listed = false;
​
BBERC721.transferFrom(address(this), msg.sender, tokenId);
​
emit NftUnlisted(tokenId);
}
​

Risk

Likelihood:

  • Seller used this function to cancel the bid with out complying 3 days auction period.

  • Seller used this function for better private offer received after auction starts.

Impact:

  • The auction period of 3 days are not followed, and leads to early private settlement.

Recommended Mitigation

The changes implement proper access control for auction cancellation and add graceful handling for unsuccessful auctions, eliminating seller manipulation while maintaining platform integrity.

+ function _unlistNFT(uint256 tokenId) internal isListed(tokenId) isSeller(tokenId, msg.sender) {
- function unlistNFT(uint256 tokenId) external isListed(tokenId) isSeller(tokenId, msg.sender) {
require(bids[tokenId].bidder == address(0), "Cannot unlist, a bid has been placed");
Listing storage listing = listings[tokenId];
listing.listed = false;
​
BBERC721.transferFrom(address(this), msg.sender, tokenId);
​
emit NftUnlisted(tokenId);
}
​
function settleAuction(uint256 tokenId) external isListed(tokenId) {
Listing storage listing = listings[tokenId];
require(listing.auctionEnd > 0, "Auction has not started (no bids)");
require(block.timestamp >= listing.auctionEnd, "Auction has not ended");
- require(bids[tokenId].amount >= listing.minPrice, "Highest bid did not meet min price");
​
​
+ if (bids[tokenId].bidder == address(0)) {
+ _unlistNFT(tokenId);
+ return;
+ } else {
+ require(bids[tokenId].amount >= listing.minPrice, "Highest bid did not meet min price");
+ _executeSale(tokenId);
}
​
}
​
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.