Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Omission `=` in `BidBeastsNFTMarket::placeBid` causes first bidder not be able to place bid on minimum bid/required price.

aliismakh

Omission = in BidBeastsNFTMarket::placeBid causes first bidder not be able to place bid on minimum bid/required price.

Description

  • As described in the project's doc, there is a minimum bid enforcement price for first bidders.

  • Due to the omission of =first bidder can only bid for a price greater than min pricebut not on exactly the min pricewhich contradicts the project's intended functionality.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
.
.
.
if (previousBidAmount == 0) {
​
requiredAmount = listing.minPrice;
@> require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
​
} else {
.
.
}

Risk

Likelihood: High

Impact: Low

Proof of Concept

  1. A seller lists an NFT for auction, and sets the min pricefor the first bid.

  2. A user decided to places a bid on a listed NFT for the first time and sets the msg.value as the min price set by the seller.

  3. The transaction fails with an error First bid must be > min price

  4. This test from your tests suit in BidBeadsNFTMarketTestwill failed due this fault.

    function test_placeFirstBid() public {
    _mintNFT();
    _listNFT();
    ​
    vm.prank(BIDDER_1);
    market.placeBid{value: MIN_PRICE}(TOKEN_ID);
    ​
    BidBeastsNFTMarket.Bid memory highestBid = market.getHighestBid(TOKEN_ID);
    assertEq(highestBid.bidder, BIDDER_1);
    assertEq(highestBid.amount, MIN_PRICE);
    assertEq(market.getListing(TOKEN_ID).auctionEnd, block.timestamp + market.S_AUCTION_EXTENSION_DURATION());
    }

Recommended Mitigation

Adjust the msg.valuecheck for the BidBeastsNFTMarket::placeBidto be equals to or greater than min priceas follows:

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
.
.
.
if (previousBidAmount == 0) {
​
requiredAmount = listing.minPrice;
- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value >= requiredAmount, "First bid must be >= min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
​
} else {
.
.
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: First Bid > Instead of >=

First bid validation uses > instead of >=, preventing valid starting bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.