Bid Beasts

First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Severity: low
Valid

Inconsistent auction timing vs README (15 minutes vs 3 days)

Inconsistent auction timing vs README (15 minutes vs 3 days)

Description

  • The README documentation states that auctions in the marketplace run for 3 days before they expire or settle. Users, bidders, and integrators would reasonably expect this duration when interacting with the contract.

  • The README documentation states that auctions in the marketplace run for 3 days before they expire or settle. Users, bidders, and integrators would reasonably expect this duration when interacting with the contract.

// BidBeastsNFTMarket.sol
uint256 public constant S_AUCTION_EXTENSION_DURATION = @> 15 minutes;

Risk

Likelihood:

  • This will always occur whenever auctions are created, since the hardcoded value in the contract (15 minutes) directly governs auction duration.

  • Users and developers relying on the README will be misled into assuming auctions last 3 days.

Impact:

  • Users may lose opportunities to participate in auctions they thought lasted 3 days, but actually expire much sooner.

  • Integrators (frontends, bots, or keeper services) relying on documentation may fail to settle or monitor auctions correctly, leading to unexpected settlement behavior and financial losses.

Proof of Concept

// README claims auction lasts 3 days.
// User Alice lists NFT #1 for auction, expecting a 3-day window.
// Contract behavior:
listing.auctionEndTime = block.timestamp + S_AUCTION_EXTENSION_DURATION;
// In reality, auction ends in 15 minutes, not 3 days.
// Result: Users may miss bidding opportunities
// and auctions close prematurely.

Recommended Mitigation

update the README to clearly state 15 minutes if that is the intended design. Both code and documentation must remain consistent.
Updates

Lead Judging Commences

cryptoghost Lead Judge
25 days ago
cryptoghost Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.