Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

First bid requires strictly greater than minPrice, breaking minimum price guarantee

0xt3sl4

Root + Impact

Description

  • When a seller lists an NFT with a minPrice, users expect to be able to place a first bid equal to that minimum price. However, the contract enforces the first bid with a strict inequality.

  • Because of the > operator, a bid equal to the listing’s minPrice will always revert. This breaks the “minimum price enforcement” guarantee stated in the project description, as the actual minimum is effectively minPrice + 1.

  • This creates user confusion and mismatched expectations between off-chain interfaces (UIs/marketplace frontends) and on-chain rules.

if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}

Risk

Likelihood: High

  • Every first bidder that tries to bid exactly the minimum price will fail.

  • Very likely to occur, as most users assume minPrice is inclusive.

Impact: Medium

  • Breaks protocol guarantees and can harm user trust.

  • Causes failed transactions and wasted gas.

  • May make auctions less attractive if bidders cannot bid at the listed minimum price.

Proof of Concept

The following test fails because bidding exactly minPrice is disallowed.Instead of accepting this as a valid bid, the contract reverts.

function test_placeFirstBid() public {
_mintNFT();
_listNFT();
​
vm.prank(BIDDER_1);
market.placeBid{value: MIN_PRICE}(TOKEN_ID);
​
BidBeastsNFTMarket.Bid memory highestBid = market.getHighestBid(TOKEN_ID);
assertEq(highestBid.bidder, BIDDER_1);
assertEq(highestBid.amount, MIN_PRICE);
assertEq(market.getListing(TOKEN_ID).auctionEnd, block.timestamp + market.S_AUCTION_EXTENSION_DURATION());
}

Recommended Mitigation

Change the first bid check to allow bids greater than or equal to the minimum price. This change will ensures that:

  • minPrice is truly the minimum valid bid.

  • User and frontend expectations align with protocol behavior.

  • Auction flow works as intended without unnecessary failed transactions.

- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value >= requiredAmount, "First bid must be >= min price");
Updates

Lead Judging Commences

cryptoghost Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: First Bid > Instead of >=

First bid validation uses > instead of >=, preventing valid starting bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.