Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Misleading Event Emission in placeBid Function Causes False Auction Settlement Logs

codeaudit0x1

Root + Impact

Description

  • Normal behavior:
    The AuctionSettled event should only be emitted after an auction is successfully settled, meaning the NFT has been transferred to the winner and funds distributed to the seller.

  • Issue:
    In the placeBid function, the AuctionSettled event is emitted during the bidding phase. This is misleading because the auction has not ended, and no settlement has occurred at that point.

require(msg.sender != previousBidder, "Already highest bidder");
@> emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
​

Risk

Likelihood:

  • Occurs every time a bid is placed after the "already highest bidder" check passes.

  • Triggers consistently in normal bidding flows.

Impact:

  • Off-chain services (marketplace UIs, analytics, explorers) will incorrectly assume the auction has been settled.

Proof of Concept

  • Call the placeBid function with a valid bid: market.placeBid{value: 1 ether}(123).

  • The contract emits the event: AuctionSettled(123, bidderAddress, sellerAddress, 1 ether).

  • Observers reading events will conclude the auction was settled and the NFT transferred.

  • Actual contract state after the call: the auction is still active (not ended).

  • The NFT remains held in the marketplace escrow (no transfer occurred).

  • No funds/seller settlement has been performed — the emitted event is misleading.

Recommended Mitigation

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
+ emit BidPlaced(tokenId, msg.sender, msg.value);
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 26 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.