Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Event Emission in `placeBid` Causes Premature Auction Settlement Signals

0xh4145

Description

In the current implementation of placeBid, the contract emits the AuctionSettled event before the auction is actually settled.

emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);

The event AuctionSettled should only be emitted once the auction ends and the highest bidder wins, not when a new bid is placed. Emitting it prematurely misleads off-chain services into treating the auction as finalized.

The correct event to emit in this context is BidPlaced.

Risk and Impact

  • Incorrect State Tracking: Off-chain services (indexers, marketplaces, or frontends) will wrongly interpret the auction as closed.

  • Premature Settlement Signals: Marketplaces and bots could act on this event, marking items as sold before the auction is actually complete.

Severity: Low – while the core auction logic on-chain remains intact, off-chain systems will desynchronize, leading to potential financial or reputational issues.

PoC

Scenario:

  1. Auction is ongoing for tokenId 101.

  2. A user places a new bid via placeBid.

  3. Instead of emitting BidPlaced, the contract emits:

{
"event": "AuctionSettled",
"args": {
"tokenId": 101,
"winner": "0xUser",
"seller": "0xSeller",
"amount": "1000000000000000000"
}
}

4.Indexers, explorers, or frontends will now wrongly record this auction as settled, even though it is still active on-chain.

Recommended Mitigation

Remove AuctionSettled event from placeBid function:

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.