Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Divide before multiply may cause precisson loss

farnad

Root + Impact

Description

  • Due to the wrong order of mathamtical operations in BidBeastsNFTMarket::placeBid, there can be some precission loss and inaccuracy in calculating bid amounts.

} else {
requiredAmount =
(previousBidAmount / 100) *
(100 + S_MIN_BID_INCREMENT_PERCENTAGE);
require(msg.value >= requiredAmount, "Bid not high enough");
​
uint256 timeLeft = 0;
if (listing.auctionEnd > block.timestamp) {
timeLeft = listing.auctionEnd - block.timestamp;
}
if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
listing.auctionEnd =
listing.auctionEnd +
S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
}

Risk

Likelihood:

  • It can happen when the user bids an amount with some small amount of wei (e.g. 1,000,000,000,000,000,050 wei). In such a case, 50 wei will be lost in calculation.

Impact:

  • It can hurt the users' perception of the app and reduces the reliability and trust.

Proof of Concept

You can test it by bidding a fee like the above example (1,000,000,000,000,000,050 wei) and see the result. The requiredAmount will be rounded down.

​

Recommended Mitigation

Change the order of operations (multiplication before division) to avoid precission loss and miscalculations of users' funds.

} else {
+ requiredAmount = previousBidAmount * (100 + S_MIN_BID_INCREMENT_PERCENTAGE) / 100;
- requiredAmount =
- (previousBidAmount / 100) *
- (100 + S_MIN_BID_INCREMENT_PERCENTAGE);
require(msg.value >= requiredAmount, "Bid not high enough");
​
uint256 timeLeft = 0;
if (listing.auctionEnd > block.timestamp) {
timeLeft = listing.auctionEnd - block.timestamp;
}
if (timeLeft < S_AUCTION_EXTENSION_DURATION) {
listing.auctionEnd =
listing.auctionEnd +
S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
}
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Integer Division Precision Loss

Integer division in requiredAmount truncates fractions, allowing bids slightly lower than intended.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.