Auction contract problem regarding highest bid display

Question

I have an Auction contract which has a function like this:

function bid() payable{
    //calculate and store highest bid value
}

But because each transaction takes time to mine, so when a user bids the highest amount, the highest bid displayed for other users takes time to be updated, which is undesirable because other users can't know what is the current minimum amount they have to bid to win.

So what should be a good solution to this problem? I thought of storing a highest bid variable in the server side that get updated whenever a user bids, but this could run into a problem when the transaction is canceled or violates something and reverted.

Answer 1

I hope you are storing the highest bid in your contract. In that case, you can handle this using your UI components. When someone places a bid you can show a loader, telling transaction pending verification and once the transaction is completed, you can display the success message as well as the then highest bid fetched from the contract.

The user(other users) can refresh the component to fetch the current highest bid from the contract before placing a bid herself. The fetching should be instantaneous. The placing of bid will take time to confirm.

You should not that in the ethereum world there is nothing that is instantaneous other than perhaps your local test network.

Answer 2

Consensys' guide about Smart Contract Security Best Practices, in its Known Attacks page explains with examples the risks and solutions of several security issues, and has some examples similar to yours, specifically the DoS with (Unexpected) revert section:

If attacker bids using a smart contract which has a fallback function that reverts any payment, the attacker can win any auction. When it tries to refund the old leader, it reverts if the refund fails. This means that a malicious bidder can become the leader while making sure that any refunds to their address will always fail. In this way, they can prevent anyone else from calling the bid() function, and stay the leader forever. A recommendation is to set up a pull payment system instead, as described earlier.

I would recommend reading the whole page, follow the recommendations and search for other resources to implement the better as possible security for your smart contracts.

Also, if you're still not using it, I would recommend using a library for secure smart contract development, like OpenZeppelin contracts.