Canto Application Specific Dollars and Bonding Curves for 1155s - Udsen's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L150 https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L174 https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L203 https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L226

Vulnerability details

Impact

The Market.sol contract implements four functions which depend on the linear bonding curve to calculate the price and fee amounts associated with their logic execution. These functions are Market.buy, Market.sell, Market.mintNFT and Market.burnNFT.

The issue here is since the users of the above four functions pay price and fee amounts based on the number of outstanding tokens (shareData[_id].tokenCount), delay in execution of any of the above functions could result in users having to pay higher amount of price and fee since the price and fee are linearly increasing as the outstanding token amount increases.

But there is no slippage protection or deadline protection for any of the above four functions. As a result the Market.buy, Market.sell, Market.mintNFT and Market.burnNFT transactions could be delayed and executed at unfavorable price points to the user thus putting the user at a disadvantage since he has to pay more in price and fee to complete the above transactions.

Proof of Concept

    function buy(uint256 _id, uint256 _amount) external {

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L150

    function sell(uint256 _id, uint256 _amount) external {

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L174

    function mintNFT(uint256 _id, uint256 _amount) external {

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L203

    function burnNFT(uint256 _id, uint256 _amount) external {

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L226

Tools Used

Manual Review and VSCode

Recommended Mitigation Steps

Hence it is recommended to implement the slippage and deadline protection to the Market.buy, Market.sell, Market.mintNFT and Market.burnNFT such that the user is given the privilege to decide at what price points he is willing to perform the execution of the transaction and after which point he does not need the transaction to be executed (or to revert). This is more fair approach to take in the best interest of the users.

Assessed type

Other