Platform: Code4rena
Start Date: 13/11/2023
Pot Size: $24,500 USDC
Total HM: 3
Participants: 120
Period: 4 days
Judge: 0xTheC0der
Id: 306
League: ETH
Rank: 96/120
Findings: 1
Award: $1.37
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: rvierdiiev
Also found by: 0x175, 0x3b, 0xMango, 0xarno, 0xpiken, Bauchibred, DarkTower, ElCid, Giorgio, HChang26, Kose, KupiaSec, Madalad, PENGUN, Pheonix, RaoulSchaffranek, SpicyMeatball, T1MOH, Tricko, Udsen, Yanchuan, aslanbek, ast3ros, bart1e, bin2chen, chaduke, d3e4, deepkin, developerjordy, glcanvas, inzinko, jasonxiale, jnforja, mahyar, max10afternoon, mojito_auditor, neocrao, nmirchev8, openwide, osmanozdemir1, peanuts, pep7siup, peritoflores, pontifex, rice_cooker, rouhsamad, t0x1c, tnquanghuy0512, turvy_fuzz, twcctop, ustas, vangrim, zhaojie, zhaojohnson
1.3743 USDC - $1.37
https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L150 https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L174 https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L194
Market::buy, Market::sell and "Market::mintNFT" lack slippage controls.
For the canto Blockchain, the lack of slippage controls will lead to sporadic situations where users will either pay more than expected for shares/mint an NFT or receive less than expected when selling shares. That's because there's no guarantee that between the time users get a price and the time the action is performed, the price hasn't changed.
According to the project's sponsor 1155tech may be deployed in blockchains other than Canto. For blockchains that allow miners to re-order transactions, the lack of slippage controls also leaves users vulnerable to sandwich attacks.
Manual review
For Market::buy add a parameter _maxTokensOut that indicates the maximum amount of tokens users are willing to pay for the amount of shares they want to buy. Do the same for "Market::mintNFT" so users can choose the maximum fee they want to pay for the amount of NFTs they want to mint.
For Market::sell add a parameter _minTokensIn that indicates the minimum amount of tokens users are willing to receive for the amount of shares they sell.
MEV
#0 - c4-pre-sort
2023-11-18T10:05:38Z
minhquanym marked the issue as duplicate of #12
#1 - c4-judge
2023-11-28T23:31:52Z
MarioPoneder marked the issue as satisfactory