Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Improper Emission of AuctionSettled Event Within Bidding Function

maybe

Root + Impact

Description

  • In normal behavior, the AuctionSettled event is emitted after an auction has been finalized — meaning the NFT is transferred and funds have been paid out.

However, the contract emits the AuctionSettled event prematurely inside the placeBid() function, even before validating the bid amount, updating the highest bid, or refunding the previous bidder. This can lead off-chain systems (such as indexers or frontends) to falsely assume the auction has ended and the NFT has been settled.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
...
// --- Buy Now Logic ---
if (listing.buyNowPrice > 0 && msg.value >= listing.buyNowPrice) {
...
}
@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
​
// --- Regular Bidding Logic ---
...
}
​

Risk

Likelihood:

  • Occurs every time a bidder who is not the previous highest bidder calls placeBid, regardless of whether their bid amount satisfies the required minimum bid.

Impact:

  • Off-chain systems monitoring AuctionSettled events may incorrectly believe a bid was accepted or an auction was settled when in fact the transaction failed.

Recommended Mitigation

Since _executeSale() already emits the AuctionSettled event when an auction actually settles, emitting it prematurely inside placeBid() (before validation and state changes) is redundant and misleading.

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.