Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing endAuction() Function and Documentation Mismatch Leading to Potential Auction Settlement Issues

0xgutzzz

Missing endAuction() Function and Documentation Mismatch Leading to Potential Auction Settlement Issues

Description:

The project documentation specifies that anyone can settle the auction after 3 days have passed by calling endAuction(tokenId) However, the current implementation of BidBeastsNFTMarket does not include any endAuction() function. Instead, the settleAuction() function allows anyone to settle the auction immediately after the auction end time, regardless of whether the 3-day period mentioned in the documentation has passed.

//@audit --> Auction should be settled by anyone after 3 days of auction but it is not implemented also no endAuction() function
function settleAuction(uint256 tokenId) external isListed(tokenId) {
Listing storage listing = listings[tokenId];
require(listing.auctionEnd > 0, "Auction has not started (no bids)");
require(block.timestamp >= listing.auctionEnd, "Auction has not ended");
require(bids[tokenId].amount >= listing.minPrice, "Highest bid did not meet min price");
​
_executeSale(tokenId);
}
​

Risk

Likelihood:

Documentation vs. Code Mismatch: Users relying on the documentation may assume they have a three-day period when they do not, leading to unexpected auction outcomes.

Impact:

Potential financial losses for sellers if auctions are settled earlier than intended.

Proof of Concept

​

Recommended Mitigation

Align Code with Documentation

  • Implement a dedicated endAuction() function with the correct 3-day period as described in the docs:

+ uint256 constant public S_GRACE_PERIOD = 3 days;
​
function endAuction(uint256 tokenId) external isListed(tokenId) {
Listing storage listing = listings[tokenId];
require(listing.auctionEnd > 0, "Auction not started");
require(block.timestamp >= listing.auctionEnd + S_GRACE_PERIOD, "Grace period not passed");
require(bids[tokenId].amount >= listing.minPrice, "Bid below min price");
_executeSale(tokenId);
}
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!