Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

First bid cannot equal minimum price

chobby

Root + Impact

Description

  • Normal behavior: In typical auctions, minPrice is the minimum acceptable bid. The first bid should succeed if it is equal to or greater than minPrice.

  • Issue: The implementation enforces that the first bid must be strictly greater than minPrice. This causes valid bids equal to minPrice to revert, reducing fairness and usability.

if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
@> require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
​
​
if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
@> require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
​

Risk

Likelihood:

  • This issue will occur whenever the first bidder submits a bid equal to the seller’s defined minPrice.

  • Given that minPrice is advertised in the listing, it is very likely bidders will attempt to submit that exact amount.

Impact:

  • Failed participation: First bidders attempting minPrice will be reverted, potentially discouraging them from retrying.

  • Reduced activity: Auctions may stall if users assume their minPrice bid should be valid but are instead reverted.

  • Lower trust: Sellers may not receive fair market engagement due to fewer successful first bids.

Proof of Concept

function testFail_FirstBidAtMinPrice() public {
vm.prank(SELLER);
market.listNFT(TOKEN_ID, MIN_PRICE, 0);
​
vm.deal(BIDDER, MIN_PRICE);
vm.prank(BIDDER);
// Expected: first bid should succeed at minPrice
// Actual: reverts with "First bid must be > min price"
market.placeBid{value: MIN_PRICE}(TOKEN_ID);
}
​

Explanation:
The test sets up a valid auction and attempts a first bid exactly at minPrice. Instead of succeeding, the bid reverts, proving that the contract enforces a > condition instead of >=.


Explanation:
The test sets up a valid auction and attempts a first bid exactly at minPrice. Instead of succeeding, the bid reverts, proving that the contract enforces a > condition instead of >=.function testFail_FirstBidAtMinPrice() public {
vm.prank(SELLER);
market.listNFT(TOKEN_ID, MIN_PRICE, 0);

vm.deal(BIDDER, MIN_PRICE);
vm.prank(BIDDER);
// Expected: should succeed as a valid first bid
// Actual: reverts with "First bid must be > min price"
market.placeBid{value: MIN_PRICE}(TOKEN_ID);
}

Recommended Mitigation

Explanation:
The condition should be relaxed to match the intended semantics of minPrice as the lowest acceptable bid. The first bid must be allowed at >= minPrice.

Code fix:

- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value >= requiredAmount, "First bid must be >= min price");
​

This ensures:

  • The seller’s minPrice is respected.

  • The first bid cannot be below minPrice.

  • User expectations are aligned with standard auction logic.

​
​
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: First Bid > Instead of >=

First bid validation uses > instead of >=, preventing valid starting bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.