Bid Beasts

Root + Impact

• Root Cause: The absence of a maximum duration cap or limit on auction extensions in the placeBid function allows the auction end time (auctionEnd) to be repeatedly extended by S_AUCTION_EXTENSION_DURATION (15 minutes) whenever a bid is placed within the last 15 minutes. The current implementation lacks a mechanism to enforce a total auction duration, enabling continuous extensions. This behavior deviates from the README’s claim that auctions end after 3 days, especially when no buyNowPrice is set to terminate the auction early.

• Impact: This vulnerability enables a Denial of Service (DoS) attack, where malicious bidders can perpetually extend the auction by placing last-minute bids, locking the seller’s NFT and funds indefinitely. Legitimate winners are prevented from settling the auction, leading to delayed payouts, reduced user trust, and potential financial losses due to decreased bidder participation. Additionally, repeated extensions incur unnecessary gas costs, further impacting usability.

Description:

The BidBeastsNFTMarket::placeBid function allows the auction duration (auctionEnd) to be extended by 15 minutes (S_AUCTION_EXTENSION_DURATION) whenever a new bid is placed within the last 15 minutes of the auction. If bidders continuously place bids in the final minutes, the auction can theoretically extend indefinitely, as there is no maximum duration cap. This behavior is particularly problematic when a seller lists an NFT with only a minPrice and no buyNowPrice, as there is no immediate purchase option to terminate the auction early. This violates the expected behavior outlined in the README, which claims auctions end after 3 days, and introduces a potential Denial of Service (DoS) attack vector.

Risk:

• Likelihood: High. The vulnerability is exploitable whenever an auction nears its end, particularly with automated bots monitoring the mempool for auctionEnd proximity. High-value auctions with competitive bidding increase the likelihood, as attackers have greater incentive to disrupt.

• Impact: High. Indefinite auction extensions lock NFTs and funds, denying sellers and winners access to their assets. This can lead to significant financial losses, erode marketplace trust, and enable griefing or DoS attacks. Gas costs from repeated extensions also burden participants.

Proof of Concept:

This test demonstrates that repeated last-minute bids can indefinitely extend the auction, effectively creating a DoS vector.

• An NFT is listed with a minPrice and no buyNowPrice.

• Multiple bids are placed 5 seconds before the auction ends, each triggering the configured 15-minute extension.

• The test confirms that the auction end time continues to increase with each bid, with no upper limit.

Results:

• First bid at timestamp 1000 sets auctionEnd = 1900 (15 minutes).

• Each subsequent bid (e.g., at 1895, 2795, etc.) extends auctionEnd by 900 seconds (15 minutes).

• After 100 bids, auctionEnd = 91000 (1000 + 100 × 900), a duration of 25 hours.

• Console logs confirm auctionEnd increases by 900 seconds per bid, with no upper limit, enabling a DoS attack.
  → Malicious bidders can place repeated last-minute bids to extend the auction indefinitely, preventing settlement and locking the NFT and funds, which disrupts the platform and deters legitimate bidders.

Add the following to the BidBeastsNFTMarketTest.t.sol test file.

Recommended Mitigation:

Introduce a maximum auction duration cap to prevent indefinite extensions. For example, enforce a total auction duration (e.g., 7 days) from the first bid or listing. Alternatively, limit the number of extensions allowed. Additionally, align the codebase with the README’s 3-day duration expectation or update the documentation to reflect the current behavior.

For example, to implement a 7-day maximum duration:

• Add a startTime field to the Listing struct to track when the auction begins (set in listNFT or first placeBid).

• Alternatively, limit the number of extensions:

  uint256 constant public S_MAX_EXTENSIONS = 10;

  mapping(uint256 => uint256) public extensionCount;

  ​

  if (timeLeft < S_AUCTION_EXTENSION_DURATION) {

  require(extensionCount[tokenId] < S_MAX_EXTENSIONS, "Max extensions reached");

  extensionCount[tokenId]++;

  listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;

  emit AuctionExtended(tokenId, listing.auctionEnd);

  }

• Update the README to clearly document the auction duration and extension behavior to avoid user confusion.