Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing NFT Return Mechanism on Failed Auctions

0xh4145

Description

The documentation states:

“If no valid bids were made, the NFT is returned to the original seller.”

However, the implementation lacks any logic to return the NFT when:

  • No bids are placed, or

  • The highest bid does not meet the minPrice.

As a result, NFTs can become locked in the contract indefinitely, since there is no automatic resolution path for failed auctions.

Risk and Impact

  • Risk: Low – functional flaw, not a direct exploit, but affects asset control.

  • Impact: Low – results in NFT lockup and poor liquidity.

Severity: Low (no direct fund theft, but significant UX and liquidity impact).

PoC

  1. Seller lists NFT with minPrice = 1 ETH.

  2. Bids received are below minPrice or none at all.

  3. Auction end time passes.

  4. Documentation states NFT should return to seller.

  5. Actual implementation does not provide this functionality — NFT remains stuck.

function testNFTStuckWithoutValidBids() public {
// No bids placed, or bid < minPrice
vm.prank(bidder);
market.placeBid{value: 0.5 ether}(tokenId);
​
// Fast forward time to after auction end
vm.warp(block.timestamp + 2 days);
​
// Attempt to settle auction
vm.prank(bidder);
market.settleAuction(tokenId);
​
// Check ownership of NFT
address nftOwner = market.ownerOf(tokenId);
​
// PoC: NFT remains stuck in contract or with the wrong owner
console.log("NFT owner after failed auction:", nftOwner);
assertEq(nftOwner, seller); // This will fail in the current implementation
}

Recommended Mitigation

Update settlement logic to check for valid bids, If no bids or highest bid < minPrice, return NFT to the seller.


if (highestBid.amount < listing.minPrice) {
// No valid bids: return NFT to seller
_transfer(address(this), listing.seller, tokenId);
​
// Clear listing data
delete listings[tokenId];
​
// Optionally, emit an event
emit AuctionFailed(tokenId, listing.seller);
return;
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

0xh4145 Submitter
about 1 month ago
cryptoghost Lead Judge
about 1 month ago
cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.