Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Integer Division Precision Loss in Fee Calculation in the `BidBeastsNFTMarketplace::_executeSale()` function

mishraji874

Description

  • Fee calculations should accurately compute the platform fee from sale amounts to ensure proper revenue collection.

  • The fee calculation uses integer division which can result in precision loss for small amounts, potentially causing the platform to lose fee revenue.

uint256 fee = (bid.amount * S_FEE_PERCENTAGE) / 100;
s_totalFee += fee;

Risk

Likelihood:

  • Occurs for any bid amount less than 20 wei (since 5% of amounts < 20 results in 0)

  • Precision loss accumulates over many small transactions

Impact:

  • Loss of platform revenue from accumulated precision errors

  • Inconsistent fee collection across different bid amounts

Proof of Concept

function test_MEDIUM_FeePrecisionLoss() public {
uint256 tokenId = _mintAndListNFT(ALICE, 1, 0); // Very low price
​
// Bid with amount that causes precision loss
uint256 bidAmount = 19; // 19 * 5 / 100 = 0 (integer division)
​
vm.prank(BOB);
market.placeBid{value: bidAmount}(tokenId);
​
// Skip time to end auction
vm.warp(block.timestamp + 16 minutes);
​
// Settle auction
vm.prank(CHARLIE);
market.settleAuction(tokenId);
​
// Fee should be 0 due to precision loss
assertEq(
market.s_totalFee(),
0,
"Fee should be 0 due to precision loss"
);
}

Recommended Mitigation

function _executeSale(uint256 tokenId) internal {
Listing storage listing = listings[tokenId];
Bid memory bid = bids[tokenId];
​
listing.listed = false;
delete bids[tokenId];
​
BBERC721.transferFrom(address(this), bid.bidder, tokenId);
​
- uint256 fee = (bid.amount * S_FEE_PERCENTAGE) / 100;
+ uint256 fee = (bid.amount * S_FEE_PERCENTAGE + 99) / 100; // Round up to prevent precision loss
s_totalFee += fee;
​
uint256 sellerProceeds = bid.amount - fee;
_payout(listing.seller, sellerProceeds);
​
emit AuctionSettled(tokenId, bid.bidder, listing.seller, bid.amount);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Integer Division Precision Loss

Integer division in requiredAmount truncates fractions, allowing bids slightly lower than intended.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.