Submission Details
Impact:
Likelihood:
Potential MEV Vulnerability in Bid Timing in the `BidBeastsNFTMarketplace::placeBid()` function
Description
-
Auction mechanisms should be resistant to MEV (Maximal Extractable Value) exploitation where sophisticated actors can extract value through transaction timing.
-
The predictable auction extension timing allows MEV bots to exploit the system by placing bids at precisely calculated moments to maximize their chances of winning.
uint256 timeLeft = 0;
if (listing.auctionEnd > block.timestamp) {
timeLeft = listing.auctionEnd - block.timestamp;
}
@> if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
Risk
Likelihood:
-
MEV bots can easily predict optimal bidding times
-
Sophisticated users have unfair advantages over regular users
Impact:
-
Unfair advantages for users with better infrastructure
-
Potential manipulation of auction outcomes
Proof of Concept
function test_LOW_MEVBidTiming() public {
uint256 tokenId = _mintAndListNFT(ALICE, MIN_PRICE, 0);
// Bob places initial bid
vm.prank(BOB);
market.placeBid{value: MIN_PRICE + 0.1 ether}(tokenId);
uint256 auctionEnd = market.getListing(tokenId).auctionEnd;
// MEV bot can predict exact timing and place bid at last second
vm.warp(auctionEnd - 1);
vm.prank(ATTACKER);
market.placeBid{value: MIN_PRICE + 0.2 ether}(tokenId);
// This extends auction and can be exploited by MEV bots
assertTrue(
block.timestamp < market.getListing(tokenId).auctionEnd,
"Auction should be extended"
);
}
Recommended Mitigation
+ // Add randomness to extension timing
+ uint256 randomExtension = S_AUCTION_EXTENSION_DURATION +
+ (uint256(keccak256(abi.encodePacked(block.timestamp, tokenId))) % (5 minutes));
if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
- listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
+ listing.auctionEnd = listing.auctionEnd + randomExtension;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.