Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect AuctionSettled Event Emission During Active Bidding

vk1033

Improper Event Emission During Bid Placement Resulting in Misleading Off-Chain Monitoring

Description

  • AuctionSettled event should only be emitted when an auction is actually completed through sale execution, indicating the final winner and sale price.

  • The current implementation incorrectly emits AuctionSettled during regular bid placement in the placeBid() function, misleading external systems and users about the auction's actual status. (Line 143)

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
// ... bid validation logic ...
require(msg.sender != previousBidder, "Already highest bidder");
@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // WRONG: Auction is not settled yet
// ... continue with regular bidding logic ...
emit BidPlaced(tokenId, msg.sender, msg.value);
}

Risk

Likelihood: High

  • This event is emitted on every valid bid placement call

Impact: Medium

  • Off-chain systems may incorrectly assume auctions are completed when they're still active

  • Frontend applications may display wrong auction status to users

Proof of Concept

The PoC demonstrates how the AuctionSettled event is incorrectly emitted during a regular bid placement, even though the auction remains active and hasn't been settled.

Add the test below to the BidBeastsMarketPlaceTest.t.sol with event:

event AuctionSettled(uint256 tokenId, address winner, address seller, uint256 price);
​
function testIncorrectEventEmittedDuringPlaceBid() public {
_mintNFT();
_listNFT();
​
uint256 BID_AMOUNT = MIN_PRICE + 1;
vm.prank(BIDDER_1);
vm.expectEmit(true, true, true, true);
emit AuctionSettled(TOKEN_ID, BIDDER_1, SELLER, BID_AMOUNT);
market.placeBid{value: BID_AMOUNT}(TOKEN_ID);
}

Run the test with:

forge test --match-path test/BidBeastsMarketPlaceTest.t.sol --match-test testIncorrectEventEmittedDuringPlaceBid

Recommended Mitigation

Remove the incorrect AuctionSettled event emission from the placeBid() function.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
// ... bid validation logic ...
require(msg.sender != previousBidder, "Already highest bidder");
- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
// ... continue with regular bidding logic ...
emit BidPlaced(tokenId, msg.sender, msg.value);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.