Fix marketplace (#335)

* validate bid amounts for creation and bidding on auctions

* keep version as 2

* validate bid amounts for update auction

Author: kumaryash90

contracts/old-marketplace/Marketplace.sol

@@ -253,7 +253,11 @@ contract Marketplace is
 
         // Tokens listed for sale in an auction are escrowed in Marketplace.
         if (newListing.listingType == ListingType.Auction) {
-            require(newListing.buyoutPricePerToken >= newListing.reservePricePerToken, "RESERVE");
+            require(
+                newListing.buyoutPricePerToken == 0 ||
+                    newListing.buyoutPricePerToken >= newListing.reservePricePerToken,
+                "RESERVE"
+            );
             transferListingTokens(tokenOwner, address(this), tokenAmountToList, newListing);
         }
 
@@ -279,7 +283,7 @@ contract Marketplace is
         // Can only edit auction listing before it starts.
         if (isAuction) {
             require(block.timestamp < targetListing.startTime, "STARTED");
-            require(_buyoutPricePerToken >= _reservePricePerToken, "RESERVE");
+            require(_buyoutPricePerToken == 0 || _buyoutPricePerToken >= _reservePricePerToken, "RESERVE");
         }
 
         if (_startTime < block.timestamp) {
@@ -304,7 +308,7 @@ contract Marketplace is
             listingType: targetListing.listingType
         });
 
-        // Must validate ownership and approval of the new quantity of tokens for diret listing.
+        // Must validate ownership and approval of the new quantity of tokens for direct listing.
         if (targetListing.quantity != safeNewQuantity) {
             // Transfer all escrowed tokens back to the lister, to be reflected in the lister's
             // balance for the upcoming ownership and approval check.
@@ -461,6 +465,7 @@ contract Marketplace is
         if (targetListing.listingType == ListingType.Auction) {
             // A bid to an auction must be made in the auction's desired currency.
             require(newOffer.currency == targetListing.currency, "must use approved currency to bid");
+            require(newOffer.pricePerToken != 0, "bidding zero amount");
 
             // A bid must be made for all auction items.
             newOffer.quantityWanted = getSafeQuantity(targetListing.tokenType, targetListing.quantity);
@@ -518,7 +523,7 @@ contract Marketplace is
             _closeAuctionForBidder(_targetListing, _incomingBid);
         } else {
             /**
-             *      If there's an exisitng winning bid, incoming bid amount must be bid buffer % greater.
+             *      If there's an existng winning bid, incoming bid amount must be bid buffer % greater.
              *      Else, bid amount must be at least as great as reserve price
              */
             require(

lib/forge-std

@@ -111,6 +111,36 @@ contract MarketplaceTest is BaseTest {
         assertEq(uint8(IMarketplace.ListingType.Auction), uint8(listing.listingType));
     }
 
+    function test_createListing_auctionListing_ZeroBuyoutAmount() public {
+        address to = getActor(0);
+        uint256 tokenId = erc721.nextTokenIdToMint();
+        erc721.mint(to, 1);
+        vm.prank(to);
+        erc721.setApprovalForAll(address(marketplace), true);
+
+        vm.warp(0);
+        Marketplace.ListingParameters memory listing;
+
+        listing.assetContract = address(erc721);
+        listing.tokenId = tokenId;
+        listing.startTime = 0;
+        listing.secondsUntilEndTime = 1 * 24 * 60 * 60; // 1 day
+        listing.quantityToList = 1;
+        listing.currencyToAccept = NATIVE_TOKEN;
+        listing.reservePricePerToken = 0;
+        listing.buyoutPricePerToken = 0;
+        listing.listingType = IMarketplace.ListingType.Auction;
+
+        vm.prank(to);
+        marketplace.createListing(listing);
+        uint256 listingId = marketplace.totalListings() - 1;
+
+        vm.prank(getActor(0));
+        vm.warp(1);
+        vm.expectRevert("bidding zero amount");
+        marketplace.offer(listingId, 1, NATIVE_TOKEN, 0, type(uint256).max);
+    }
+
     function test_offer_bidAuctionNativeToken() public {
         vm.deal(getActor(0), 100 ether);
 
@@ -148,6 +178,21 @@ contract MarketplaceTest is BaseTest {
         assertEq(winningBid.pricePerToken, 2 ether);
     }
 
+    function test_revert_offer_bidZeroAmount() public {
+        vm.warp(0);
+        (uint256 listingId, ) = createERC721Listing(
+            getActor(0),
+            NATIVE_TOKEN,
+            123456 ether,
+            IMarketplace.ListingType.Auction
+        );
+
+        vm.prank(getActor(0));
+        vm.warp(1);
+        vm.expectRevert("bidding zero amount");
+        marketplace.offer(listingId, 1, NATIVE_TOKEN, 0, type(uint256).max);
+    }
+
     // function test_closeAuctionForCreator_afterBuyout() public {
     //     vm.deal(getActor(0), 100 ether);
     //     vm.deal(getActor(1), 100 ether);