Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Front-running Vulnerability in Auction Extension in the `BidBeastsNFTMarketplace::placeBid()` function

mishraji874

Description

  • Auction extensions should provide fair opportunities for all bidders without allowing manipulation of timing.

  • The auction extension mechanism can be exploited by front-runners who can monitor pending transactions and place bids just before auction end, repeatedly extending auctions to gain unfair advantages.

uint256 timeLeft = 0;
if (listing.auctionEnd > block.timestamp) {
timeLeft = listing.auctionEnd - block.timestamp;
}
if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
@> listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}

Risk

Likelihood:

  • MEV bots and sophisticated bidders can easily exploit this mechanism

  • Occurs whenever auctions are in their final extension period

Impact:

  • Unfair bidding advantages for sophisticated users with better infrastructure

  • Potential manipulation of auction timing

Proof of Concept

function test_MEDIUM_AuctionExtensionFrontRunning() public {
uint256 tokenId = _mintAndListNFT(ALICE, MIN_PRICE, 0);
​
// Bob places initial bid
vm.prank(BOB);
market.placeBid{value: MIN_PRICE + 0.1 ether}(tokenId);
​
uint256 auctionEnd = market.getListing(tokenId).auctionEnd;
​
// Move time close to auction end
vm.warp(auctionEnd - 5 minutes);
​
// Charlie can front-run by placing bid just before auction ends
// This extends the auction, giving Charlie advantage
vm.prank(CHARLIE);
market.placeBid{value: MIN_PRICE + 0.2 ether}(tokenId);
​
uint256 newAuctionEnd = market.getListing(tokenId).auctionEnd;
assertGt(newAuctionEnd, auctionEnd, "Auction should be extended");
​
// This creates unfair advantage as Charlie can always extend auction
assertEq(
newAuctionEnd,
auctionEnd + 15 minutes,
"Extension should be 15 minutes"
);
}

Recommended Mitigation

+ uint256 constant public MAX_AUCTION_EXTENSIONS = 3;
+ mapping(uint256 => uint256) public auctionExtensions;
​
if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
+ require(auctionExtensions[tokenId] < MAX_AUCTION_EXTENSIONS, "Max extensions reached");
+ auctionExtensions[tokenId]++;
listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeast Marketplace: Auction Duration Miscalculation

BidBeast marketplace contains a flaw in its auction timing mechanism. This causes the contract to miscalculate the actual end time of an auction, resulting in auctions that either conclude prematurely or run longer than specified.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.