Escher contest - dic0de's results

Lines of code

https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/FixedPrice.sol#L109 https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/OpenEdition.sol#L92

Vulnerability details

Impact

The project uses the native token as the currency of trade when selling and buying. This evident in the buy () functions of FixedPrice, OpenEdition and LPDA contracts where msg.value is used. However, when the sale is finalized and amounts needs to be transferred out of the contract before selfDestruct transfer method is used instead of call which is seen here https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/LPDA.sol#L85-L86, https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/FixedPrice.sol#L109 , https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/OpenEdition.sol#L92.

It is advised to use call instead of transfer when handling native token. You can read more about this security issue here https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/ as well as through this past audit report https://github.com/code-423n4/2022-02-redacted-cartel-findings/issues/2

Proof of Concept

1. https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/LPDA.sol#L85-L86,
2. https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/FixedPrice.sol#L109 ,
3. https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/OpenEdition.sol#L92.

Tools Used

Recommended Mitigation Steps