Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Incomplete Clearing of Listing Data After Sale Can Cause Inconsistent State

0xh4145

Description

After _executeSale, the contract sets listings[tokenId].listed = false, but other fields such as seller, minPrice, and buyNowPrice remain unchanged in storage.

This leaves stale data attached to the token ID, which can cause confusion or logical errors if the NFT is later re-listed. For example:

  • Off-chain indexers may interpret the stale minPrice or buyNowPrice as still valid.

  • Developers or future contract upgrades that rely on these fields may behave incorrectly.

The correct approach is to fully clear the listing data once the sale is executed.

Risk and Impact

  • Risk: Low – not a direct fund theft vector, but creates hidden state inconsistencies.

  • Impact: Unexpected Behavior on Re-Listing: Old pricing data may persist, causing incorrect assumptions.

Severity: Low – impacts reliability and maintainability of the marketplace.

PoC

function test_ListingNotCleared() public {
_mintNFT();
_listNFT();
​
vm.prank(BIDDER_1);
market.placeBid{value: MAX_PRICE}(TOKEN_ID);
​
// Listing data remains except `listed = false`
BidBeastsNFTMarket.Listing memory listing = market.listings(tokenId);
​
// The NFT is sold, but seller/minPrice/buyNowPrice values are still stored in contract
assertEq(listing.seller, seller); // Shows stale seller info
assertEq(listing.minPrice, MIN_PRICE); // Still holds stale price
assertEq(listing.buyNowPrice, MAX_PRICE); // Still holds stale price
}

These values persist even though the listing is no longer active, creating ambiguity.

Recommended Mitigation

Fully clear the listing struct in `_executeSale` after a successful sale using the delete keyword:

function _executeSale(uint256 tokenId) internal {
Listing storage listing = listings[tokenId];
Bid memory bid = bids[tokenId];
​
- listing.listed = false;
+ delete listings[tokenId];
delete bids[tokenId];
​
...
}

This ensures that all fields are reset, preventing stale data from causing confusion or bugs in future re-listings.

Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.