Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Misplaced auction settled event creates misleading blockchain logs

anchabadze

Description:

The placeBid() function contains a misplaced AuctionSettled event emission that occurs during regular bid placement rather than actual auction completion. This event is emitted outside the buy-now logic block, causing it to fire every time a user places a regular bid, not when an auction is actually settled. This creates false auction completion records on the blockchain and can mislead off-chain systems, analytics tools, and users monitoring auction activities.

_executeSale()contains emit AuctionSettled(tokenId, bid.bidder, listing.seller, bid.amount);

Attack path:

  1. User calls placeBid(tokenId) with a regular bid amount (not triggering buy-now logic)

  2. The function passes initial validation checks

  3. AuctionSettled event is incorrectly emitted with bid details before the bid is actually processed

  4. Off-chain systems record this as a completed auction when it's actually just a bid placement

  5. The auction continues normally with the bid being placed

  6. When the auction actually ends via settleAuction() or takeHighestBid(), another AuctionSettled event is emitted from _executeSale()

  7. This results in duplicate and misleading auction settlement records for the same auction

Impact:

Blockchain logs contain false auction completion records

Analytics dashboards, indexers, and monitoring tools receive incorrect data

Frontend applications may display incorrect auction status information

Recommended Mitigation:

Remove the misplaced AuctionSettled event emission from the regular bidding flow:

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
Listing storage listing = listings[tokenId];
address previousBidder = bids[tokenId].bidder;
uint256 previousBidAmount = bids[tokenId].amount;
​
require(listing.seller != msg.sender, "Seller cannot bid");
require(listing.auctionEnd == 0 || block.timestamp < listing.auctionEnd, "Auction ended");
​
// --- Buy Now Logic ---
if (listing.buyNowPrice > 0 && msg.value >= listing.buyNowPrice) {
uint256 salePrice = listing.buyNowPrice;
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!