Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

First Bid Gets Rejected Even at Minimum Price

empyrean

First Bid Gets Rejected Even at Minimum Price

Description

First bids on listed NFTs must meet or exceed the seller's minimum price to start the auction. The validation incorrectly requires bids strictly greater than minPrice, rejecting valid bids at the exact minimum.

if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
@>require(msg.value > requiredAmount, "First bid must be > min price");@>
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}

Risk

Likelihood:

  • When a bidder submits exactly the minPrice to meet seller's floor.

  • In auctions with low minPrice attracting budget-conscious participants.

Impact:

  • Rejects acceptable bids, frustrating users and delaying auctions.

  • Reduces marketplace activity as sellers miss potential sales.

Proof of Concept

Lists NFT, bids exact minPrice, expects revert error, checks auction timer still zero to show rejected valid bid.

function testFirstBidRejectedAtMinPrice() public {
_mintNFT();
_listNFT();
​
// Bid exactly minPrice - should succeed but fails due to >
vm.deal(BIDDER_1, MIN_PRICE);
vm.prank(BIDDER_1);
vm.expectRevert("First bid must be > min price");
market.placeBid{value: MIN_PRICE}(TOKEN_ID);
​
// Verify no auction started
BidBeastsNFTMarket.Listing memory listing = market.getListing(TOKEN_ID);
assertEq(listing.auctionEnd, 0);
}

Recommended Mitigation

Changes strict greater than to greater or equal in require, allowing bids at exact minPrice to start auction.

if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value >= requiredAmount, "First bid must meet min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.