Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

MEDIUM ISSUE: Reentrancy in placeBid Function

mostafapahlevani93

Root + Impact

Description

  • The placeBid function makes external calls to _payout() before completing all state updates, creating reentrancy opportunities.

function placeBid(uint256 tokenId) external payable {
// ... validation logic
bids[tokenId] = Bid(msg.sender, msg.value); // State update
if (previousBidder != address(0)) {
_payout(previousBidder, previousBidAmount); // External call
}
// More logic continues after external call
}

Risk

Likelihood:

  • Reentrancy can occur when _payout calls external addresses

  • Malicious bidders can create contracts that reenter during payout

  • The vulnerability exists on every bid that refunds a previous bidder

Impact:

  • Potential manipulation of auction state during reentrancy

  • Double spending or bid manipulation possible

  • Contract state inconsistency

Proof of Concept

contract ReentrantBidder {
BidBeastsNFTMarket marketplace;
uint256 targetToken;
function attack(uint256 tokenId) external payable {
targetToken = tokenId;
marketplace.placeBid{value: msg.value}(tokenId);
}
receive() external payable {
// Reentrant call during payout
if (address(marketplace).balance > 0) {
marketplace.placeBid{value: 0.1 ether}(targetToken);
}
}
}

Recommended Mitigation

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
// ... validation logic
+ // Store previous bidder info before state changes
+ address refundAddress = bids[tokenId].bidder;
+ uint256 refundAmount = bids[tokenId].amount;
+
// Update state first
bids[tokenId] = Bid(msg.sender, msg.value);
// External interactions last
- if (previousBidder != address(0)) {
- _payout(previousBidder, previousBidAmount);
- }
+ if (refundAddress != address(0)) {
+ _payout(refundAddress, refundAmount);
+ }
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeast Marketplace: Reentrancy In PlaceBid

BidBeast Marketplace has a Medium-severity reentrancy vulnerability in its "buy-now" feature that allows an attacker to disrupt the platform by blocking sales or inflating gas fees for legitimate users.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.