Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Event Emission in `placeBid` Causes Premature Auction Settlement Signals

0xh4145

Description

In the current implementation of placeBid, the contract emits the AuctionSettled event before the auction is actually settled.

emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);

The event AuctionSettled should only be emitted once the auction ends and the highest bidder wins, not when a new bid is placed. Emitting it prematurely misleads off-chain services into treating the auction as finalized.

The correct event to emit in this context is BidPlaced.

Risk and Impact

  • Incorrect State Tracking: Off-chain services (indexers, marketplaces, or frontends) will wrongly interpret the auction as closed.

  • Premature Settlement Signals: Marketplaces and bots could act on this event, marking items as sold before the auction is actually complete.

Severity: Low – while the core auction logic on-chain remains intact, off-chain systems will desynchronize, leading to potential financial or reputational issues.

PoC

Scenario:

  1. Auction is ongoing for tokenId 101.

  2. A user places a new bid via placeBid.

  3. Instead of emitting BidPlaced, the contract emits:

{
"event": "AuctionSettled",
"args": {
"tokenId": 101,
"winner": "0xUser",
"seller": "0xSeller",
"amount": "1000000000000000000"
}
}

4.Indexers, explorers, or frontends will now wrongly record this auction as settled, even though it is still active on-chain.

Recommended Mitigation

Remove AuctionSettled event from placeBid function:

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!