Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Aunction does not enforce the 3 days auction end policy

duma999

Aunction does not enforce the 3 days auction end policy

Description

The competition's description explained that every Auction should have an end of exactly 3 days but the function placeBid that set the deadline do otherwise :

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
​
...
​
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
​
...
}
​

It use the S_AUCTION_EXTENSION_DURATION which is set to 15 minutes,
This mean that the Aunction could end as quickly as 15 minutes after the first bid.

Risk

impact(High) : The deadline of exactly 3 days is not follow, this could lead to speed auctions, undermining the core functionnality of the protocol.

likelyhood(High) : Every time the first bid is set, the function could end 15 minutes after and not 3 days.

Proof of Concept

Add this test to BidBeastsMarketPlaceTest.t.sol

function test_Auction_End() public {
_mintNFT();
_listNFT();
​
vm.prank(BIDDER_1);
market.placeBid{value: MIN_PRICE + 0.01 ether}(TOKEN_ID);
​
BidBeastsNFTMarket.Bid memory highestBid = market.getHighestBid(TOKEN_ID);
assertEq(highestBid.bidder, BIDDER_1);
assertEq(highestBid.amount, MIN_PRICE + 0.01 ether);
assertEq(market.getListing(TOKEN_ID).auctionEnd, block.timestamp + market.S_AUCTION_EXTENSION_DURATION());
​
// Try to settle directly after the bid but fail(expected)
vm.expectRevert("Auction has not ended");
market.settleAuction(TOKEN_ID);
​
// Advance the time for 15 minutes
vm.warp(block.timestamp + 15 minutes);
​
// settleAuction is available after 15 minutes after the start of the auction instead of 3 days
market.settleAuction(TOKEN_ID);
assertEq(nft.ownerOf(TOKEN_ID), BIDDER_1);
}

Recommended Mitigation

add this line line at the start of the contract :

uint256 constant public S_AUCTION_EXTENSION_DURATION = 15 minutes;
+ uint256 constant public S_AUCTION_DURATION = 3 days;
uint256 constant public S_MIN_NFT_PRICE = 0.01 ether;
uint256 constant public S_FEE_PERCENTAGE = 5;
uint256 constant public S_MIN_BID_INCREMENT_PERCENTAGE = 5;

and change the following line in placeBid :

function placeBid(uint256 tokenId) external payable isListed(tokenId) {
​
...
​
requiredAmount = listing.minPrice;
require(msg.value > requiredAmount, "First bid must be > min price");
- listing.auctionEnd = block.timestamp + S_AUCTION_EXTENSION_DURATION;
+ listing.auctionEnd = block.timestamp + S_AUCTION_DURATION;
emit AuctionExtended(tokenId, listing.auctionEnd);
...
}
Updates

Lead Judging Commences

cryptoghost Lead Judge
2 months ago
cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Improper Documentation

Documentation for BidBeasts Marketplace is incomplete or inaccurate, potentially leading to misconfigurations or security misunderstandings.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!