Foundation Drop contest - Ch_301's results

Lines of code

https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/mixins/nftDropMarket/NFTDropMarketFixedPriceSale.sol#L183-L189

Vulnerability details

Impact

The users could lose their rights to mint all the limitPerAccount or some of them

Proof of Concept

If any user buys these NFTs from the secondary market or just he minted with another address and then transfers it to this address. In these cases, this user can’t bypass this check

File:        /main/contracts/mixins/nftDropMarket/NFTDropMarketFixedPriceSale.sol

if (IERC721(nftContract).balanceOf(msg.sender) + count > saleConfig.limitPerAccount) {
      if (saleConfig.limitPerAccount == 0) {
        // Provide a more targeted error if the collection has not been listed.
        revert NFTDropMarketFixedPriceSale_Must_Have_Sale_In_Progress();
      }
      revert NFTDropMarketFixedPriceSale_Cannot_Buy_More_Than_Limit(saleConfig.limitPerAccount);
    }

even though he never mint in this collections

Recommended Mitigation Steps

Add check to inquire about their NFTs come from or check if he achieves the limitPerAccount by minting not just check the balanceOf(msg.sender)