mintBatch() for 2+ iterations will use stored funds or will revert
Summary
The use of msg.value in a loop is a mispattern as its value remains fixed during the whole function call. So, for n-iteration of the loop: n * msg.value is sent. Given that the msg.sender didn't send that much: either the contract has enough stored funds to be used for free, or the call will revert
Vulnerability Detail
This is a common issue. Several blog posts explain it (1, 2)
Assuming the excess msg.value funds aren't stuck in excess in FEE_MANAGER, consider keeping track of address(this).balance between calls on the Edition contract to only forward what's left.
Additionally, consider checking that the final balance isn't subtracted by less than the initial msg.value, or it means that the user could use stored funds for free
threadmodeling
high
mintBatch()
for 2+ iterations will use stored funds or will revertSummary
The use of
msg.value
in a loop is a mispattern as its value remains fixed during the whole function call. So, for n-iteration of the loop:n * msg.value
is sent. Given that themsg.sender
didn't send that much: either the contract has enough stored funds to be used for free, or the call will revertVulnerability Detail
This is a common issue. Several blog posts explain it (1, 2)
The i:
Impact
Use of stored funds for free (theft of stored funds)
Or DOS
mintBatch
doesn't work for arrays of size > 1Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/editions/Edition.sol#L277-L289
Tool used
Manual Review
Recommendation
Assuming the excess
msg.value
funds aren't stuck in excess inFEE_MANAGER
, consider keeping track ofaddress(this).balance
between calls on theEdition
contract to only forward what's left. Additionally, consider checking that the final balance isn't subtracted by less than the initialmsg.value
, or it means that the user could use stored funds for free