Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

AuctionSettled Event is Incorrectly Emitted When a New Bid is Placed

folijr01

Root + Impact

Description

  • The placeBid function incorrectly emits an AuctionSettled event every time a regular bid is successfully placed. An auction is only truly "settled" when a winner is finalized and assets are transferred, which is handled by the

    _executeSale function. This incorrect event emission will cause off-chain services and front-end applications to misrepresent the state of active auctions, reporting them as finished when they are still ongoing.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • This occurs every time a user places a valid bid on an auction that does not trigger the "Buy Now" condition.

  • An off-chain application or user is monitoring contract events to track auction states.

Impact:

  • The integrity of the contract's event logs is compromised, making reliable tracking of auction states impossible.

  • Users may be misled by front-end applications into believing an auction has ended, potentially causing them to miss opportunities to place further bids.

Proof of Concept

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
// ...
require(msg.sender != previousBidder, "Already highest bidder");
emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // Incorrect Event
// --- Regular Bidding Logic ---
// ...
}

Recommended Mitigation

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
+ add this code
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!