Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[M-4] The `BidBeastsNFTMarket::placeBid` function emits the `AuctionSettled` event on any bid placement, causing misinformation and confusion for users.

alexscherbatyuk

The BidBeastsNFTMarket::placeBid function emits the AuctionSettled event on any bid placement, causing misinformation and confusion for users.

Description

  • The BidBeastsNFTMarket::placeBid function emits the AuctionSettled event on any bid placement, while it should only be emitted if the bid equals or is greater than _buyNowPrice. The event

  • Inaccurate information and confusion for users and decentralized applications (dapps) that depend on the protocol's logs.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
...
​
require(msg.sender != previousBidder, "Already highest bidder");
//@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
​
// --- Regular Bidding Logic ---
uint256 requiredAmount;
​
...
emit BidPlaced(tokenId, msg.sender, msg.value);
}

Risk

Likelihood: High

  • This event emission occurs on each valid bid.

  • No specific condition.

Impact: Low

  • Inaccurate information for users.

  • Confusion for users’ decentralized applications (dapps) that depend on the protocol’s logs

Proof of Concept

Add the following code snippet to the `BidBeastsMarketPlaceTest.t.sol` test file.

event AuctionSettled(uint256 tokenId, address winner, address seller, uint256 price);
​
function testPlaceBidEmitsAuctionSettledOnAnyBid() public {
uint256 S_MIN_BID_INCREMENT_PERCENTAGE = 5;
uint256 firstBidAmount = MIN_PRICE + 1;
uint256 secondBidAmount = firstBidAmount + (firstBidAmount * S_MIN_BID_INCREMENT_PERCENTAGE) / 100;
​
_mintNFT();
_listNFT();
​
vm.prank(BIDDER_1);
vm.expectEmit(true, true, true, true, address(market));
emit AuctionSettled(TOKEN_ID, BIDDER_1, SELLER, MIN_PRICE + 1);
market.placeBid{value: MIN_PRICE + 1}(TOKEN_ID);
​
vm.prank(BIDDER_2);
vm.expectEmit(true, true, true, true, address(market));
emit AuctionSettled(TOKEN_ID, BIDDER_2, SELLER, secondBidAmount);
market.placeBid{value: secondBidAmount}(TOKEN_ID);
}

Recommended Mitigation

Remove the `AuctionSettled` event emission from the `BidBeastsNFTMarket::placeBid` function.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
...
​
require(msg.sender != previousBidder, "Already highest bidder");-
- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
​
// --- Regular Bidding Logic ---
uint256 requiredAmount;
​
...
emit BidPlaced(tokenId, msg.sender, msg.value);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!