Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect First Bid Price Validation Allows Rejection of Minimum Price Bids

codeaudit0x1

Root + Impact

Description

  • Normally, in an NFT auction, the first bidder should be able to place a bid equal to or greater than the seller’s minPrice.

  • In the current implementation, the contract enforces that the first bid must be strictly greater than the minPrice. This blocks a bidder from placing exactly the minimum price as the first valid bid.

// Root cause in the codebase with @> marks to highlight the relevant section
​
if (previousBidAmount == 0) {
requiredAmount = listing.minPrice;
@> require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
​

Risk

Likelihood:

  • Occurs whenever the first bidder tries to submit a bid equal to the seller’s specified minimum price.

  • This is a common user action in auctions, so it will occur frequently in production.

Impact:

  • Bids exactly equal to the minPrice will always be rejected, breaking user expectations.

  • This reduces auction participation and may discourage bidders, leading to reduced final sale prices.

Proof of Concept

// Seller lists NFT with a minPrice of 0.01 ether
market.listNFT(tokenId, 0.01 ether, 0);
​
// Bidder attempts to place exactly 0.01 ether
market.placeBid{value: 0.01 ether}(tokenId);
​
// This reverts with "First bid must be > min price"
​

Recommended Mitigation

- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value >= requiredAmount, "First bid must be >= min price");
Updates

Lead Judging Commences

cryptoghost Lead Judge 26 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: First Bid > Instead of >=

First bid validation uses > instead of >=, preventing valid starting bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.