Forgotten Runes Warrior Guild contest - dipp's results

L-01: Mintlist Phase able to Start Before the Dutch Auction Phase

Line References

ForgottenRunesWarriorsMinter.sol#L171-L195

ForgottenRunesWarriorsMinter.sol#L480-L500

Description

If the mintlist summon starts before the final price is reached in the auction and is not set, then users who use mintlistSummon or publicSummon could pay more than what they should. They would be unable to receive a refund by using the contract since the refund functionality only considers the amount spent in the bidSummon function.

Since the mintlist start time is expected to be 24 hours after the Dutch auction start time, and the public summon 24 hours after that, this scenario is unlikely but is still possible.

Recommended Mitigation Steps

A requirement that mintlistStartTime is at least 380 minutes after daStartTime in the setPhaseTimes function could be added since the final price should be equal to lowestPrice 380 minutes after the start of the auction or should already be set if all warriors are sold before that.