Closed sherlock-admin3 closed 4 months ago
Escalate
Dup of #280
Escalate
Dup of #280
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Agree with the escalation, planning to accept and duplicate with #280
Result: Medium Duplicate of #280
Kalogerone
medium
Editions::mintBatch function will always revert
Summary
Editions::mintBatch
function used to mint more than 1 tokens to a single receiver will always revert.Vulnerability Detail
This is the
Editions::mintBatch
function:As we can see, the function is sending the whole
msg.value
to theFeeManager.sol
contract inside afor loop
. This means, if thetokenIds_
array has alength > 1
, then the function will revert because it has already sent the wholemsg.value
and at the 2nd loop there are no more funds to send.Impact
The
mintBatch
function is unusable as it will always revert if a user wants to mint more than 1 tokens, which is the whole purpose of this function. Otherwise, the user would just use themint
function.Proof of Code
Paste the following code in
Edition.t.sol
file:Running the test with
forge test --mt test_mint_batch_doesnt_work -vvvvv
we can see that it passes (so it reverts as expected) and it also reverts withOutOfFunds
error.Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/d7f60952df22da00b772db5d3a8272a988546089/wallflower-contract-v2/src/editions/Edition.sol#L277
Tool used
Manual Review
Recommendation
My recommendation is to calculate the necessary fee in each loop and only transfer the fee for each mint:
Duplicate of #280