Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Improper handling of auction settlement and event emission in `BidBeastsNFTMarket`

lochaeth

Root + Impact

Description

The AuctionSettled event is emitted when an auction is finalized, either via a regular bid settlement or a "Buy Now" purchase. In the current implementation, there is a risk that the auction settlement logic could be manipulated, allowing a malicious actor to either:

  • Prevent the previous highest bidder from being refunded correctly.

  • Influence the emitted AuctionSettled event to misrepresent auction results.

This can lead to inconsistent accounting in failed transfer credits and misleading event logs that off-chain services or dApps rely on.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
Listing storage listing = listings[tokenId];
address previousBidder = bids[tokenId].bidder;
uint256 previousBidAmount = bids[tokenId].amount;
​
require(listing.seller != msg.sender, "Seller cannot bid");
​
// auctionEnd == 0 => no bids yet => allowed
// auctionEnd > 0 and block.timestamp >= auctionEnd => auction ended => block
require(listing.auctionEnd == 0 || block.timestamp < listing.auctionEnd, "Auction ended");
​
// --- Buy Now Logic ---
​
if (listing.buyNowPrice > 0 && msg.value >= listing.buyNowPrice) {
uint256 salePrice = listing.buyNowPrice;
uint256 overpay = msg.value - salePrice;
​
// EFFECT: set winner bid to exact sale price (keep consistent)
bids[tokenId] = Bid(msg.sender, salePrice);
listing.listed = false;
​
if (previousBidder != address(0)) {
_payout(previousBidder, previousBidAmount);
}
​
// NOTE: using internal finalize to do transfer/payouts. _executeSale will assume bids[tokenId] is the final winner.
_executeSale(tokenId);
​
// Refund overpay (if any) to buyer
if (overpay > 0) {
_payout(msg.sender, overpay);
}
​
return;
}
​
require(msg.sender != previousBidder, "Already highest bidder");
@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
​
// --- Regular Bidding Logic ---
uint256 requiredAmount;
​
if (previousBidAmount == 0) {
​
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
​
} else {
requiredAmount = (previousBidAmount / 100) * (100 + S_MIN_BID_INCREMENT_PERCENTAGE);
require(msg.value >= requiredAmount, "Bid not high enough");
​
uint256 timeLeft = 0;
if (listing.auctionEnd > block.timestamp) {
timeLeft = listing.auctionEnd - block.timestamp;
}
if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
}
​
// EFFECT: update highest bid
bids[tokenId] = Bid(msg.sender, msg.value);
​
if (previousBidder != address(0)) {
_payout(previousBidder, previousBidAmount);
}
​
emit BidPlaced(tokenId, msg.sender, msg.value);
}

Risk

Likelihood: Medium

  • Exploiting this requires either crafting a failed payout scenario (e.g., using a contract that rejects Ether) or manipulating the timing of bids.

  • Regular users are unlikely to encounter this unless deliberately testing edge cases.

Impact: Low

  • None directly, but can lead to financial losses indirectly

  • corrupts event logging and monitoring

Recommended Mitigation

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
Listing storage listing = listings[tokenId];
address previousBidder = bids[tokenId].bidder;
uint256 previousBidAmount = bids[tokenId].amount;
​
require(listing.seller != msg.sender, "Seller cannot bid");
require(listing.auctionEnd == 0 || block.timestamp < listing.auctionEnd, "Auction ended");
// REMOVE THIS LINE:
// emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
// Continue with existing logic...
if (listing.buyNowPrice > 0 && msg.value >= listing.buyNowPrice) {
// ... buy now logic ...
}
- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
// ... rest of function ...
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!