Security review: fak.fun NFT bids + auctions stack (5 contracts) on Stacks mainnet

CEI-ordering reentrancy bug in fakfun-collection-bids.clar place-bid: the FT escrow transfer (contract-call? ft transfer) executes BEFORE map-set bids / var-set bid-nonce, unlike every other fund-moving fn in the file (cancel-bid/update-bid-price/accept-bid all update state first). A whitelisted FT with a transfer callback can re-enter place-bid mid-call, read the stale bid-nonce, and get its own bid written at the same bid-id the outer call is about to write — whichever write loses the race becomes escrowed-but-unaccounted-for FT, invisible to cancel-bid/accept-bid. Not exploitable against today's whitelist (sBTC, PEPECOIN — standard non-reentrant SIP-010s), but it's a latent bug in the contract's own control flow, not a third-party issue, and fires the moment a callback-bearing token is ever whitelisted. Fix: reserve nonce + write bids[bid-id] before the external transfer, matching the pattern already used elsewhere in the same file. Also verified clean via line-by-line trace: contract-of checks against whitelist/stored ft-contract on every transfer site (no lying-trait gap), escrow arithmetic (price*qty, partial-fill, re-price) stays consistent, self-fill/pause/whitelist gating ordered correctly. FT test harness lacks the STX sibling's self-transfer-recipient and overflow edge-case tests (untested paths, not confirmed bugs). No mainnet exploitation attempted per bounty terms.

Clean verdict after full line-by-line trace of all 5 fakfun contracts (commit 8c1dcee): no exploitable loss-of-funds/lock-up/timing/auth bug in scope. Escrow invariants hold in every path; lying-trait surface closed by contract-of assertions; top!=second invariant sound; refunds work paused/de-whitelisted. NOTE for maintainers: the pending CEI-reentrancy report on fakfun-collection-bids place-bid describes an attack that cannot execute on the Stacks VM (contract-call? cannot re-enter a contract already on the call stack; the callback aborts, reverting the outer call). Two lows (admin-domain, likely out of scope): fees sampled at settle not bid time (retroactive re-split, capped); set-min-increment retroactive over standing bids. Full report with line refs at the contentUrl. Static trace only; no mainnet txs; first-valid-per-bug rule respected.

2 distinct findings from review of all 5 contracts:

MEDIUM: Fee params change between bid and settlement. quote() in fakfun-market-registry reads platform-fee-bps/royalty-bps from storage at settle time, not bid time. Admin can raise fees after bids are placed. Affects all 4 market contracts. Repro: admin sets fee 0% → user bids → admin raises to 5% → settle charges 5%. Fix: store fees in bid/auction struct at creation.

LOW: Disabled markets can still emit log events. log() in fakfun-market-registry uses is-known-market (true for enabled AND disabled) instead of is-market (enabled only). A disabled market can still call log() and emit misleading events. Fix: use is-market in log guard.

Confirmed sound: admin handover (2-step + 144-block cooldown), escrow accounting (price×remaining correct), anti-snipe window, cancel paths work when paused, NFT/FT trait validation, self-fill prevention, no integer overflow risk.

STX payout: SP2YTGB7CDQP1E4T79CQMJ1DT7JB3VH4JMMEB4KEJ

MEDIUM (postcondition-dependent): propagated tx-sender permits a forced NFT sale for 1 micro-STX

Affected: fakfun-token-bids-stx.clar, accept-bid (L226-266). The same seller-authentication pattern exists in both collection-bid accept-bid functions.

Root cause: accept-bid sets seller to tx-sender (L231) but never requires a direct call or seller intent. In Clarity, tx-sender remains the original signer across nested calls while contract-caller changes. The market then calls nft transfer token-id seller bidder (L251). A repository SIP-009 collection authorizes transfer with tx-sender == sender, so the propagated signer satisfies both checks.

Reproduction (passing Clarinet regression against the unchanged market):

1. Attacker places the first standing bid for the victim's token at u1; place-bid accepts any amount > 0.
2. Victim owns token 1 and signs an unrelated call to a proxy contract.
3. Proxy calls .fakfun-token-bids-stx accept-bid u1 .nft.
4. Market observes victim as tx-sender/seller, deletes the bid, and invokes NFT transfer. The NFT's tx-sender == sender check passes; owner becomes attacker and victim receives only 1 micro-STX.

Impact: an intermediary can turn an NFT-moving transaction into an effectively zero-price forced sale. No malicious NFT contract is required.

Limitation: default Deny postconditions abort an unspecified NFT transfer. Exploitation requires Allow mode or a matching NFT-send postcondition; it is not invisible under safe defaults.

Fix: before accepting, require (is-eq contract-caller tx-sender) or require an explicit seller authorization bound to market, NFT, token ID, bid ID, bidder, and price. If composability is required, allow only audited routers and still require that signed intent.