Submission Details
Severity:
Misleading event when placing bid
Misleading event when placing bid
Description
The protocol emits AuctionSettled every time a bid is placed which is a misleading event for 3rd parties listening to.
Risk
Likelihood: High
Every time a bid is placed the event is emitted
Impact: Low
It can mess up the data of 3rd party integrations
Proof of Concept
The following test case demonstrates the event emission
function test_anyone_can_bid_for_listed_item() public {
vm.prank(PROTOCOL_OWNER);
nft.mint(SELLER);
vm.startPrank(SELLER);
nft.approve(address(market), 0);
vm.expectEmit(true, true, true, true);
emit NftListed(0, SELLER, MIN_PRICE + 1, 0);
market.listNFT(0, MIN_PRICE + 1, 0);
vm.stopPrank();
assertEq(nft.ownerOf(0), address(market));
BidBeastsNFTMarket.Listing memory listing = market.getListing(0);
assertEq(listing.listed, true);
assertEq(listing.seller, SELLER);
assertEq(listing.minPrice, MIN_PRICE + 1);
assertEq(listing.buyNowPrice, 0);
assertEq(listing.auctionEnd, 0);
vm.warp(1 days);
vm.startPrank(BIDDER_1);
vm.expectEmit(true, true, true, true);
@> emit AuctionSettled(0, BIDDER_1, SELLER, MIN_PRICE + 2);
vm.expectEmit(true, true, false, false);
emit AuctionExtended(0, 1 days + 15 minutes);
vm.expectEmit(true, true, true, false);
emit BidPlaced(0, BIDDER_1, MIN_PRICE + 2);
market.placeBid{value: MIN_PRICE + 2}(0);
vm.stopPrank();
listing = market.getListing(0);
assertEq(listing.listed, true);
assertEq(listing.seller, SELLER);
assertEq(listing.minPrice, MIN_PRICE + 1);
assertEq(listing.buyNowPrice, 0);
assertEq(listing.auctionEnd, 1 days + 15 minutes);
BidBeastsNFTMarket.Bid memory bid = market.getHighestBid(0);
assertEq(bid.bidder, BIDDER_1);
assertEq(bid.amount, MIN_PRICE + 2);
}
Recommended Mitigation
The event is redudant in the bidding flow, so it can be removed
...
require(msg.sender != previousBidder, "Already highest bidder");
-emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
...
Updates
Lead Judging Commences
cryptoghost about 1 month ago
Submission Judgement Published Assigned finding tags:
BidBeasts Marketplace: Incorrect Event Emission
placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.