Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Inefficient auction extension mechanism allows excessive auction prolongation

anchabadze

Description:

The auction extension mechanism in the placeBid() function uses an inefficient time calculation that can excessively prolong auctions beyond the intended anti-sniping protection period. When a bid is placed within 15 minutes of the auction end, the system extends the auction by adding 15 minutes to the current auctionEnd time rather than setting it to 15 minutes from the current timestamp. This results in participants receiving significantly more than the intended 15-minute response window, potentially extending auctions by up to 30 minutes in some scenarios.

Attack path:

  1. User places a bid when there are 14 minutes remaining until auction end

  2. The extension logic triggers: listing.auctionEnd = listing.auctionEnd + 15 minutes

  3. This results in 14 + 15 = 29 minutes total remaining time from the moment of bid placement

  4. Other participants now have 29 minutes to respond instead of the intended 15 minutes

Impact:

Auctions prolongation far beyond reasonable timeframes

Recommended Mitigation:

Replace the current extension mechanism with a more efficient approach that provides exactly 15 minutes from the time of bid placement:

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
// ... existing validation logic ...
​
// --- Regular Bidding Logic ---
uint256 requiredAmount;
​
if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
} else {
requiredAmount = (previousBidAmount * (100 + S_MIN_BID_INCREMENT_PERCENTAGE)) / 100;
require(msg.value >= requiredAmount, "Bid not high enough");
​
// IMPROVED: Always set to exactly 15 minutes from now if within extension window
uint256 timeLeft = 0;
if (listing.auctionEnd > block.timestamp) {
timeLeft = listing.auctionEnd - block.timestamp;
}
if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
}
​
// ... rest of bidding logic ...
}
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 27 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeast Marketplace: Auction Duration Miscalculation

BidBeast marketplace contains a flaw in its auction timing mechanism. This causes the contract to miscalculate the actual end time of an auction, resulting in auctions that either conclude prematurely or run longer than specified.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.