Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Low: First-bid check disallows minPrice exactly (availability / logic mismatch)

andysakov

Low: First-bid check disallows minPrice exactly (availability / logic mismatch)

Description

  • Normal behavior: First bid typically allowed at exactly minPrice.

  • Issue: Code requires strictly greater than minPrice, contradicting typical UX and the included test expectations.

148:153:2025-09-bid-beasts/src/BidBeastsNFTMarketPlace.sol

requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
// @> Root: Strictly '>' instead of '>='; blocks valid first bids at min price

Risk

Likelihood:

  • Every first bid at exactly minPrice

  • Very common scenario

Impact:

  • Prevents expected bids; test failures

  • Poor UX and reduced auction participation

Proof of Concept

When attempting to place a bid at the min price, it'll revert even though according to the tests it should allow this behavior

function test_placeFirstBid() public {
_mintNFT();
_listNFT();
​
vm.prank(BIDDER_1);
market.placeBid{value: MIN_PRICE}(TOKEN_ID);
​
BidBeastsNFTMarket.Bid memory highestBid = market.getHighestBid(
TOKEN_ID
);
assertEq(highestBid.bidder, BIDDER_1);
assertEq(highestBid.amount, MIN_PRICE);
assertEq(
market.getListing(TOKEN_ID).auctionEnd,
block.timestamp + market.S_AUCTION_EXTENSION_DURATION()
);
}

Recommended Mitigation

Change the operator to support exact min price first bids

- require(msg.value > requiredAmount, "First bid must be > min price");
+ require(msg.value >= requiredAmount, "First bid must be >= min price");
Updates

Lead Judging Commences

cryptoghost Lead Judge 27 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: First Bid > Instead of >=

First bid validation uses > instead of >=, preventing valid starting bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.