Forgotten Runes Warrior Guild contest - fatherOfBlocks's results

16,000 Warrior NFTs sold in a phased Dutch Auction.

General Information

Platform: Code4rena

Start Date: 03/05/2022

Pot Size: $30,000 USDC

Total HM: 6

Participants: 93

Period: 3 days

Judge: gzeon

Id: 118

League: ETH

Forgotten Runes

Findings Distribution

Researcher Performance

Rank: 23/93

Findings: 3

Award: $342.49

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: throttle

Also found by: 0xDjango, BowTiedWardens, WatchPug, defsec, dipp, fatherOfBlocks, gzeon, hake, reassor, shung, unforgiven

Labels

bug
duplicate
2 (Med Risk)

Awards

296.7571 USDC - $296.76

External Links

Lines of code

https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L480-L500 https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L441-L471

Vulnerability details

Impact

Time variable validations (daStartTime, mintlistStartTime, publicStartTime, claimsStartTime, selfRefundsStartTime) are only done in setPhaseTimes() and not even all validations. These validations should be performed:

  • daStartTime > block.timestamp
  • mintlistStartTime > daStartTime
  • publicStartTime > mintlistStartTime
  • claimsStartTime > publicStartTime

I came to this conclusion taking into account the timeline written on line 117.

If you decide not to add validations as require in each setter function, at least set all validations in setPhaseTimes().

#0 - gzeoneth

2022-06-18T18:06:42Z

Duplicate of #27

ForgottenRunesWarriorsMinter.sol

  • L557 - the setLowestPrice() function should not allow setting lowestPrice > starPrice, it could generate inconsistencies in currentDaPrice().

  • L550 - the setStartPrice() function should not allow setting startPrice < lowestPrice, it could generate inconsistencies in currentDaPrice().

  • L564 L571 - if daDropInterval or daPriceCurveLength were set to zero by mistake, it would generate a temporary DoS in currentDaPrice() and consequently in bidSummon().

  • L441 L471 - In the setDaStartTime() or setSelfRefundsStartTime() functions, it is good to let you pass any date, it could generate a denial of services in the purchase functions.

ForgottenRunesWarriorsMinter.sol

  • L163 L220 L259 L355 - Less gas could be spent if these lines were made unckecked and instead of i++, ++i was made.

  • L287 L288 L289 L295 L391 -These lines can become unckecked since it is not necessary to validate these operations.

  • L390 - It is only used once in the function, so you would save 3 gas if you call line 391 directly.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter