Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

L01. Wrong event usage in placeBid

accessdenied

Root + Impact

Description

  • Normal behavior: When a new bid is placed, the BidPlaced event should be emitted to indicate a bid has occurred. When the auction is finalized, AuctionSettled should be emitted. Off-chain systems rely on these events to track auction progress.

  • Issue: In the placeBid() function, the contract emits AuctionSettled prematurely while the auction is still ongoing, before updating the highest bid. This can confuse off-chain listeners into thinking the auction is finalized when it is not, even though the correct BidPlaced event is emitted later.

// Root cause in the codebase with @> marks to highlight the relevant section
emit @> AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // emitted too early
​

Risk

Likelihood:

  • Occurs every time a user places a bid on an NFT.

  • Happens because the developer mistakenly emitted AuctionSettled in the middle of the bidding logic.

Impact:

  • Off-chain tools (UIs, analytics, or bots) may misinterpret the auction status.

  • Low operational impact: the contract state, bids, and payments remain correct.

Proof of Concept

function test_wrongEventEmission() public {
_mintNFT();
_listNFT();
​
vm.prank(BIDDER_1);
vm.expectEmit(true, true, true, true);
emit AuctionSettled(TOKEN_ID, BIDDER_1, SELLER, MIN_PRICE); // currently emitted incorrectly
market.placeBid{value: MIN_PRICE}(TOKEN_ID);
​
// Check that BidPlaced is still emitted correctly later
BidBeastsNFTMarket.Bid memory highestBid = market.getHighestBid(TOKEN_ID);
assertEq(highestBid.bidder, BIDDER_1);
assertEq(highestBid.amount, MIN_PRICE);
}
​

Recommended Mitigation

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // remove incorrect premature event
+ // No change needed: BidPlaced is already emitted correctly at the end
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!