Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Spec–Implementation Mismatch on Auction Deadline and Settlement

fffuuuming

Root + Impact

Description

The document says there exist an auction deadline of exactly 3 days and "After 3 days, anyone can call endAuction(tokenId) to finalize the auction." However, in hte implementation, not only the function name but also the deafline range is differ with what it claims

  • The function name should be settleAuction()

  • According to BidBeastsNFTMarketPlace.settleAuction, it verifies whether the auction deadline has already passed by checking listing.auctionEnd

    require(block.timestamp >= listing.auctionEnd, "Auction has not ended");

  • listing.auctionEnd is extended by S_AUCTION_EXTENSION_DURATION whenever a new bid is placed

  • S_AUCTION_EXTENSION_DURATION is set to 15 minutes, not 3 days as stated in the documentation.

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
...
​
// --- Regular Bidding Logic ---
uint256 requiredAmount;
​
if (previousBidAmount == 0) {
...
@> // extended by S_AUCTION_EXTENSION_DURATION
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
} else {
...
if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
@> // extended by S_AUCTION_EXTENSION_DURATION
listing.auctionEnd = listing.auctionEnd + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
}
​
...
emit BidPlaced(tokenId, msg.sender, msg.value);
}
​
​
function settleAuction(uint256 tokenId) external isListed(tokenId) {
Listing storage listing = listings[tokenId];
require(listing.auctionEnd > 0, "Auction has not started (no bids)");
@> // auction end check
require(block.timestamp >= listing.auctionEnd, "Auction has not ended");
require(bids[tokenId].amount >= listing.minPrice, "Highest bid did not meet min price");
​
_executeSale(tokenId);
}
​

Risk

Likelihood: High

  • Already wrong/mismatched logic between code and documentation

Impact: Medium

  • Integrators mis-handle flows due to wrong function name and deadline logic

Recommended Mitigation

Just align code or docs

Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.