Platform: Code4rena
Start Date: 30/10/2023
Pot Size: $49,250 USDC
Total HM: 14
Participants: 243
Period: 14 days
Judge: 0xsomeone
Id: 302
League: ETH
Rank: 195/243
Findings: 1
Award: $0.04
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: btk
Also found by: 00xSEV, 0x175, 0x180db, 0x3b, 0xAlix2, 0xJuda, 0xpiken, 0xraion, 3th, 836541, Al-Qa-qa, AvantGard, Aymen0909, Beosin, ChrisTina, DarkTower, DeFiHackLabs, EricWWFCP, Kose, Kow, KupiaSec, MrPotatoMagic, Neo_Granicen, PENGUN, PetarTolev, Ruhum, Soul22, SovaSlava, SpicyMeatball, Talfao, The_Kakers, Toshii, Tricko, VAD37, Viktor_Cortess, ZdravkoHr, _eperezok, alexxander, audityourcontracts, ayden, bird-flu, bronze_pickaxe, codynhat, critical-or-high, danielles0xG, degensec, droptpackets, evmboi32, fibonacci, flacko, gumgumzum, ilchovski, immeas, innertia, jacopod, joesan, ke1caM, kk_krish, mojito_auditor, nuthan2x, phoenixV110, pontifex, r0ck3tz, sces60107, seeques, sl1, smiling_heretic, stackachu, t0x1c, trachev, turvy_fuzz, ubl4nk, ustas, xAriextz, xuwinnie, y4y
0.038 USDC - $0.04
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/MinterContract.sol#L363 https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/MinterContract.sol#L236 https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/ERC721.sol#L407
Updating state after safeMint external call can cause: Single allowlist user can mint all allowlist spots available. Single regular user can mint more than the max minting amount set by the admin.
git clone https://github.com/danielles0xG/c4-nexgen-0923.gitcd c4-nexgen-0923forge installforge test --mt test_reenter_mint -vvvv
https://github.com/danielles0xG/c4-nexgen-0923/blob/f611bdbd338e7691c70152cb90fed0057dabd833/hardhat/test/foundry/Gen.t.sol#L105manual review
Update state before any external call and/or protect any function involving minting with a non-reentrant modifier from OZ or custom mutual exclusion modifier that locks the function while executing.
ERC721
#0 - c4-pre-sort
2023-11-20T01:06:14Z
141345 marked the issue as duplicate of #51
#1 - c4-pre-sort
2023-11-26T14:02:11Z
141345 marked the issue as duplicate of #1742
#2 - c4-judge
2023-12-08T16:33:46Z
alex-ppg marked the issue as satisfactory
#3 - c4-judge
2023-12-08T16:34:04Z
alex-ppg marked the issue as partial-25
#4 - c4-judge
2023-12-09T00:18:52Z
alex-ppg changed the severity to 3 (High Risk)