Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

AuctionSettled Event is Incorrectly Emitted When a New Bid is Placed

folijr01

Root + Impact

Description

  • The placeBid function incorrectly emits an AuctionSettled event every time a regular bid is successfully placed. An auction is only truly "settled" when a winner is finalized and assets are transferred, which is handled by the

    _executeSale function. This incorrect event emission will cause off-chain services and front-end applications to misrepresent the state of active auctions, reporting them as finished when they are still ongoing.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • This occurs every time a user places a valid bid on an auction that does not trigger the "Buy Now" condition.

  • An off-chain application or user is monitoring contract events to track auction states.

Impact:

  • The integrity of the contract's event logs is compromised, making reliable tracking of auction states impossible.

  • Users may be misled by front-end applications into believing an auction has ended, potentially causing them to miss opportunities to place further bids.

Proof of Concept

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
// ...
require(msg.sender != previousBidder, "Already highest bidder");
emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value); // Incorrect Event
// --- Regular Bidding Logic ---
// ...
}

Recommended Mitigation

- emit AuctionSettled(tokenId, msg.sender, listing.seller, msg.value);
+ add this code
Updates

Lead Judging Commences

cryptoghost Lead Judge 29 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.