Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Premature AuctionSettled emit on bid misleads indexers and UIs

emfarih

Root + Impact

Description

  • Normal behavior: The AuctionSettled event should only be emitted when the auction has truly finalized — meaning the NFT has been transferred to the winning bidder and the seller has received payment.

  • Issue: In the placeBid function, the AuctionSettled event is emitted immediately upon a bid being placed, before the auction is actually finalized. This causes off-chain services (indexers, explorers, dashboards) to falsely record completed sales even though the auction is still active.

require(msg.sender != previousBidder, "Already highest bidder");
@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // emitted prematurely during bidding

Risk

Likelihood:

  • This occurs every time a user places a bid in an active auction.

  • Any auction with at least one bid will generate this misleading event.

Impact:

  • Off-chain systems such as UIs, explorers, or analytics platforms will record false “sale completed” events, corrupting history.

  • Automated business processes (accounting, notifications, webhooks) may be triggered prematurely, causing confusion or errors.

Proof of Concept

// Scenario:
//
// 1. Seller lists tokenId 0 with minPrice = 0.01 ETH.
// 2. A bidder calls placeBid(0) with 0.02 ETH.
//
// Expected outcome:
// - Auction remains active
// - Highest bid updates to 0.02 ETH
// - Auction end time extended
// - No AuctionSettled event until finalization
//
// Actual outcome:
// - AuctionSettled(0, bidder, seller, 0.02 ETH) emitted immediately
// - Off-chain systems believe the auction has closed and the NFT is sold
// - NFT remains escrowed, auction is ongoing
​

The event misrepresents state. Off-chain systems trust events more
than storage, so this creates a false “sold” record and breaks UX/business logic.

Recommended Mitigation

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
+ // Remove this premature emission.
+ // Only emit AuctionSettled inside the finalization logic (_executeSale),
+ // after the NFT transfer and payouts are complete.

By moving AuctionSettled to the finalization function (_executeSale), the event will only be emitted when the auction actually ends — either via takeHighestBid, settleAuction, or buy-now logic. This ensures that on-chain events always reflect true auction state, keeping off-chain consumers consistent with the real outcome.

Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!