`saleConfig.limitPerAccount` can be overriden

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-foundation/blob/792e00df429b0df9ee5d909a0a5a6e72bd07cf79/contracts/mixins/nftDropMarket/NFTDropMarketFixedPriceSale.sol#L183

Vulnerability details

[PNM-001] saleConfig.limitPerAccount can be overriden

Links

• https://github.com/code-423n4/2022-08-foundation/blob/792e00df429b0df9ee5d909a0a5a6e72bd07cf79/contracts/mixins/nftDropMarket/NFTDropMarketFixedPriceSale.sol#L183

Description

The contract NFTDropMarketFix implements a limit on the amount of NFTs that an account can mint with the function mintFromFixedPriceScale. This is done via a comparison of the balanceOf() of an account and the saleConfig.limitPerAccount. However, this check can be bypassed by account holders transferring the NFTs to other accounts offchain, causing the balanceOf() the account to decrease, thus allowing the account to potentially buy more than the saleConfig.limitPerAccount.

PoC / Attack Scenario

• Account holder Alice calls the function mintFromFixedPriceScale with the count parameter equal to the saleConfig.limitPerAccount.
• Alice then transfers the NFTs to a separate account (owned by her) using direct transfer calls.
• The balanceOf() Alice decreases from the previous action.
• Alice can then call mintFromFixedPriceScale again with a non-zero count, to gain more NFTs.
• Alice can then transfer back the NFTs from the separate account (as both are owned by her), making her total balance > the saleConfig.limitPerAccount.

  Suggested Fix

Consider creating an availableMint value for every account, and when mintFromFixedriceScale is called, decrease the amount minted from the availableMint.

[ghost]

My issue here https://github.com/code-423n4/2022-08-foundation-findings/issues/59 with a proof of concept test in foundry but I disagree with severity as there are no loss of funds.

There are also too many dups for this issue so I won't list all of them down. Please check the de-dupe tool shared by kartoonjoy.

[HardlyDifficult]

Dupe of https://github.com/code-423n4/2022-08-foundation-findings/issues/59