Root + Impact

Description

• The README states that auctions run for a fixed duration of 3 days, and end with an endAuction() call. In contrast, the actual contract logic implements a rolling 15-minute extension auction (S_AUCTION_EXTENSION_DURATION) and finalization is performed via settleAuction().

• This inconsistency creates confusion for auditors, testers, and participants since they may interact with the system based on incorrect documentation. Misaligned expectations could lead to disputes over auction results or missed settlement windows.

Risk

Likelihood:

• Developers and auditors rely on the README for contest scope and assumptions.

• Users will expect auctions to last exactly 3 days, but the contract ends them dynamically with extensions.

Impact:

• Auditors may miss important bugs because they review against incorrect assumptions.

• Users may lose opportunities or funds if they rely on incorrect auction timing (e.g., bidding too late).

Proof of Concept

A Proof of Concept demonstrates how the documented specification (README) diverges from the actual implementation (contract). In this case, the README states that auctions last a fixed 3-day duration and must be ended via endAuction(tokenId). However, a PoC review of the contract shows that auctions are governed by a 15-minute rolling extension and finalized via settleAuction(tokenId).

By comparing the stated flow in the README with the actual Solidity logic (S_AUCTION_EXTENSION_DURATION = 15 minutes), auditors and users can clearly see the mismatch. This theoretical PoC doesn’t require transaction execution—it relies on source code vs documentation analysis to highlight the root cause of misunderstanding.

Recommended Mitigation

Update the README to match contract logic (15-minute extensions, settleAuction(), Buy Now feature) Or change the contract to match the README.