Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

L01. Wrong event usage in placeBid

accessdenied

Root + Impact

Description

  • Normal behavior: When a new bid is placed, the BidPlaced event should be emitted to indicate a bid has occurred. When the auction is finalized, AuctionSettled should be emitted. Off-chain systems rely on these events to track auction progress.

  • Issue: In the placeBid() function, the contract emits AuctionSettled prematurely while the auction is still ongoing, before updating the highest bid. This can confuse off-chain listeners into thinking the auction is finalized when it is not, even though the correct BidPlaced event is emitted later.

// Root cause in the codebase with @> marks to highlight the relevant section
emit @> AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // emitted too early
​

Risk

Likelihood:

  • Occurs every time a user places a bid on an NFT.

  • Happens because the developer mistakenly emitted AuctionSettled in the middle of the bidding logic.

Impact:

  • Off-chain tools (UIs, analytics, or bots) may misinterpret the auction status.

  • Low operational impact: the contract state, bids, and payments remain correct.

Proof of Concept

function test_wrongEventEmission() public {
_mintNFT();
_listNFT();
​
vm.prank(BIDDER_1);
vm.expectEmit(true, true, true, true);
emit AuctionSettled(TOKEN_ID, BIDDER_1, SELLER, MIN_PRICE); // currently emitted incorrectly
market.placeBid{value: MIN_PRICE}(TOKEN_ID);
​
// Check that BidPlaced is still emitted correctly later
BidBeastsNFTMarket.Bid memory highestBid = market.getHighestBid(TOKEN_ID);
assertEq(highestBid.bidder, BIDDER_1);
assertEq(highestBid.amount, MIN_PRICE);
}
​

Recommended Mitigation

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // remove incorrect premature event
+ // No change needed: BidPlaced is already emitted correctly at the end
Updates

Lead Judging Commences

cryptoghost Lead Judge 26 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.