Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Misleading Event Emission in placeBid Function Causes False Auction Settlement Logs

codeaudit0x1

Root + Impact

Description

  • Normal behavior:
    The AuctionSettled event should only be emitted after an auction is successfully settled, meaning the NFT has been transferred to the winner and funds distributed to the seller.

  • Issue:
    In the placeBid function, the AuctionSettled event is emitted during the bidding phase. This is misleading because the auction has not ended, and no settlement has occurred at that point.

require(msg.sender != previousBidder, "Already highest bidder");
@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
​

Risk

Likelihood:

  • Occurs every time a bid is placed after the "already highest bidder" check passes.

  • Triggers consistently in normal bidding flows.

Impact:

  • Off-chain services (marketplace UIs, analytics, explorers) will incorrectly assume the auction has been settled.

Proof of Concept

  • Call the placeBid function with a valid bid: market.placeBid{value: 1 ether}(123).

  • The contract emits the event: AuctionSettled(123, bidderAddress, sellerAddress, 1 ether).

  • Observers reading events will conclude the auction was settled and the NFT transferred.

  • Actual contract state after the call: the auction is still active (not ended).

  • The NFT remains held in the marketplace escrow (no transfer occurred).

  • No funds/seller settlement has been performed — the emitted event is misleading.

Recommended Mitigation

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
+ emit BidPlaced(tokenId, msg.sender, msg.value);
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!