Closed code423n4 closed 2 years ago
I believe this is the intended behaviour. It is the creator's decision whether or not to reduce the number of NFTs available for mint.
ACK.
We believe this is low risk. Assets are not compromised, and many users may believe that a more limited supply actually increases the value for holders.
This feature is working as intended / by design. If a collection does not sell out, we wanted to give the creator tools to handle that situation gracefully. Generally in the ecosystem, rarity is considered a value add. If the creator made a collection that's too large for their existing community then they have the option of constricting supply - which allows the floor price to potentially float above the original sale price.
We provide creator tools, it's up to them to gauge their community and only take actions that benefit their holders.
Agree that it's a feature, not a bug, for creators to tweak the mint supply if needed.
Lines of code
https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/mixins/collections/SequentialMintCollection.sol#L34 https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/NFTDropCollection.sol#L220-L222 https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/mixins/collections/SequentialMintCollection.sol#L86-L93 https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/NFTDropCollection.sol#L171-L187
Vulnerability details
Impact
For an NFT drop collection after creation, collectors can view the following public
maxTokenId
state variable to see the maximum tokenId that can be minted. Knowing this, collectors can decide on how many NFTs of this NFT drop collection they want to mint.https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/mixins/collections/SequentialMintCollection.sol#L34
After creating the NFT drop collection, the creator can call the following
updateMaxTokenId
function to updatemaxTokenId
. However, thisupdateMaxTokenId
function is still callable by the creator after minting begins. The creator can maliciously updatemaxTokenId
after minting starts to block further minting if there is an incentive for doing so.https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/NFTDropCollection.sol#L220-L222
https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/mixins/collections/SequentialMintCollection.sol#L86-L93
After collectors mint some NFTs, the creator blocks further minting by calling the
updateMaxTokenId
function. Afterwards, calling the followingmintCountTo
function will always revert. As a result, the collectors are unable to mint their desired number of NFTs and waste gas by sending the relevant transactions.https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/NFTDropCollection.sol#L171-L187
Proof of Concept
Please add the following test in the
Can decrease maxTokenId
describe
block intest\collections\NFTDropCollection\update.ts
. This test will pass to demonstrate the described scenario.Tools Used
VSCode
Recommended Mitigation Steps
A boolean state variable can be added in the
NFTDropCollection
contract to indicate whether minting has started or not. When themintCountTo
function is called for the first time, this state variable can be changed totrue
. When this state variable istrue
, calling theupdateMaxTokenId
function should revert so creators cannot changemaxTokenId
anymore after minting begins.