Bid Beasts

Description

The contract uses the global variable block.timestamp to determine when an auction has ended inside settleAuction:

Since miners can influence block.timestamp within a small range (commonly up to ~900 seconds, depending on network rules), this creates a manipulation vector:

• A miner or colluding entity could advance the timestamp to meet the listing.auctionEnd requirement, allowing premature auction settlement.

• While the impact window is small, it undermines fairness for bidders expecting the auction to run until the exact advertised end time.

Risk and Impact

• Risk: Low – requires miner collusion or block production control.

• Impact: High – an attacker can end auctions slightly earlier than intended, depriving bidders of their fair chance to submit last-minute bids.

Severity: Medium – exploitation requires specific conditions (miner influence) but creates significant fairness issues.

PoC

1. Auction is scheduled to end at T = 1000.

2. At T = 995, a malicious miner includes a block with block.timestamp = 1000.

3. The auction contract interprets the auction as finished.

4. The miner (or colluding attacker) immediately calls settleAuction(tokenId) and finalizes the sale.

5. Other bidders expecting the auction to run for 5 more seconds lose their opportunity to participate.

Recommended Mitigation

Integrate a decentralized time oracle or automation service (e.g., Chainlink Keepers) to provide reliable and tamper-resistant auction finality.