Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Auction Deadline Mismatch Between Documentation and Implementation

chobby

Root + Impact

Description

  • Normal behavior: The README specifies auctions have a strict deadline of exactly 3 days from listing. Users should expect auctions to end at that fixed time.

  • Issue: The implementation dynamically extends auctions when bids are placed near the end (S_AUCTION_EXTENSION_DURATION). This creates an anti-sniping mechanism, not a fixed-length auction.

if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
@> listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
...
if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
@> listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
​

Risk

Likelihood:

  • Occurs whenever bids are placed close to auction end.

  • Highly likely in active markets where last-minute bidding is common.

Impact:

  • User confusion: Bidders expecting a 3-day hard deadline may wrongly assume they’ve won.

  • Unfair play: Wealthy bidders can repeatedly extend auctions, exhausting smaller competitors.

  • Trust loss: Mismatch between docs and code may create disputes.

Proof of Concept

// Start auction at time T
market.listNFT(TOKEN_ID, MIN_PRICE, 0);
​
// Bid at T + 3 days - 1 minute
// Expect auction to end at T + 3 days
// Actual: auctionEnd extended by S_AUCTION_EXTENSION_DURATION
​

Explanation:
Instead of ending exactly at 3 days, the auction continues beyond the documented deadline.

Recommended Mitigation

Explanation:
Align implementation with documentation, or update docs to reflect the actual design.

Fix options:

  1. If strict 3-day auctions are intended → remove the extension logic.

  2. If anti-sniping extensions are intended → update documentation to explicitly state auctions may extend when bids are placed near the end.

Updates

Lead Judging Commences

cryptoghost Lead Judge
about 1 month ago
cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.