Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Inconsistent Bid Requirement Operators in the `BidBeastsNFTMarketPlace.sol` contract

mishraji874

Description

  • Bid validation logic should be consistent to prevent unexpected behavior and maintain clear auction rules.

  • The first bid requires msg.value > minPrice (strictly greater than) while subsequent bids require msg.value >= requiredAmount (greater than or equal), creating logical inconsistency.

require(msg.value > requiredAmount, "First bid must be > min price");
​
// vs
​
require(msg.value >= requiredAmount, "Bid not high enough");

Risk

Likelihood:

  • Inconsistency exists in every auction's bid validation logic

  • Can be exploited when combined with precision loss issues

Impact:

  • Unexpected bidding behavior confusing users

  • Potential exploitation when combined with other precision issues

Proof of Concept

function test_HIGH_InconsistentBidRequirementOperators() public {
uint256 tokenId = _mintAndListNFT(ALICE, MIN_PRICE, 0);
​
// First bid must be > minPrice (strictly greater than)
vm.prank(BOB);
vm.expectRevert("First bid must be > min price");
market.placeBid{value: MIN_PRICE}(tokenId); // Equal to minPrice should fail
​
// First bid with amount > minPrice should succeed
vm.prank(BOB);
market.placeBid{value: MIN_PRICE + 0.001 ether}(tokenId);
​
// Calculate required increment for second bid
uint256 requiredIncrement = ((MIN_PRICE + 0.001 ether) / 100) * (100 + 5);
​
// VULNERABILITY: Second bid uses >= operator (allows equal amount)
// If requiredIncrement equals the previous bid due to precision loss,
// bidder can bid the same amount
vm.prank(CHARLIE);
market.placeBid{value: requiredIncrement}(tokenId); // >= allows equal amount
}

Recommended Mitigation

if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value > requiredAmount, "First bid must be > min price");
// ... rest of logic
} else {
requiredAmount = (previousBidAmount / 100) * (100 + S_MIN_BID_INCREMENT_PERCENTAGE);
- require(msg.value >= requiredAmount, "Bid not high enough");
+ require(msg.value > requiredAmount, "Bid must be higher than previous bid");
// ... rest of logic
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: First Bid > Instead of >=

First bid validation uses > instead of >=, preventing valid starting bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.