Open howlbot-integration[bot] opened 2 months ago
koolexcrypto marked the issue as satisfactory
koolexcrypto changed the severity to 3 (High Risk)
koolexcrypto marked the issue as not a duplicate
koolexcrypto marked the issue as primary issue
koolexcrypto marked the issue as selected for report
koolexcrypto changed the severity to 2 (Med Risk)
Lines of code
https://github.com/code-423n4/2024-07-traitforge/blob/279b2887e3d38bc219a05d332cbcb0655b2dc644/contracts/TraitForgeNft/TraitForgeNft.sol#L288
Vulnerability details
Impact
The golden god is the special entropy of 999,999. This entropy is set at slotIndexSelectionPoint and numberIndexSelectionPoint 1. These are in the third part of the entropy list. When forging two NFTs it increases the current generations generationMintCounts. This means that less NFTs of that generation can be minted, as there are only 10,000 NFTs per generation. Therefore the golden god might not be reached and no golden god for that generation exists.
Proof of Concept
First mint all NFTs from generation one. The POC also lists any forger NFT and sends merger NFTs the merger address. To be able to read the new id, _tokenIds in TraitForgeNft must be changed to public.
Next increase the current generation by minting the first generation two NFT:
After that, forge all available generation one NFTs, that were tracked in the previous step:
After that there is the following state:
Now mint all the remaining generation two NFTs using the same helper function (
_mintGeneration
) as before.After that, there is the following state:
Reading the current
currentSlotIndex
+currentNumberIndex
see - they were updated to be public so there are readable - andslotIndexSelectionPoint
+numberIndexSelectionPoint
see:It is show that the generation 2 is fully minted without reaching the golden god of that generation.
Notice: While this is an extreme example (all gen 1 NFTs were forged). This can still happen if only a few are forged and the golden god is far back in the entropy list. Also consider that NFTs can be forged multiple times.
Full POC
The POC is written in foundry:
Full logs:
Tools Used
manual review
Recommended Mitigation Steps
There is always a chance that no golden god is minted, as the NFT contract in the current form can't predict when users use mint or forge. In theory the users could call forge for the last 100s or 1000s NFTs.
Consider reverting on the last forge if the golden god is not yet minted and add a additional condition when minting, that the last NFT of a generation is guaranteed to be the golden god if not yet minted.
Assessed type
Other