Canto Application Specific Dollars and Bonding Curves for 1155s - OMEN's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/1155tech-contracts/src/Market.sol#L114-L127

Vulnerability details

Impact

there will be front running in create Share

Proof of Concept

malicious user front run and take over that user trying to create share with specific string . attacker will create share with that string name , user transaction will be reverted.

     function createNewShare(
    string memory _shareName,
    address _bondingCurve,
    string memory _metadataURI
) external onlyShareCreator returns (uint256 id) {
    require(whitelistedBondingCurves[_bondingCurve], "Bonding curve not whitelisted");
    require(shareIDs[_shareName] == 0, "Share already exists");//*@audit can it be front run?
    id = ++shareCount;
    shareIDs[_shareName] = id;
    shareData[id].bondingCurve = _bondingCurve;
    shareData[id].creator = msg.sender;
    shareData[id].metadataURI = _metadataURI;
    emit ShareCreated(id, _shareName, _bondingCurve, msg.sender);
}

Tools Used

manual view

Recommended Mitigation Steps

mapping(string => uint256) public shareIDs; instead of string to uint256 , use hashing system and make bytes 32 to uint256 , hash the string and msg.sender , user as bytes 32

Assessed type

MEV