Canto Application Specific Dollars and Bonding Curves for 1155s - merlinboii's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L226-L241

Vulnerability details

Risk: Medium

• Impact: High
• Likelihood: Low

Related Files

• https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L226-L241

Impact

Indirect Share Participation with Less Payout allows NFT holders, in addition to regular shareholders, to burn the NFT. This enables them to participate indirectly (through burnNFT()) in specific shares with less payout than direct participation through buy().

Vulnerabilities

The Market contract allows not only the holder of a share to burn the NFT token, conflicting with what is described in the project details.

---

By calling the burnNFT function, callers who do not hold shares can participate in a specific share by paying only the required fee for burning their owned NFT.

227:   uint256 fee = getNFTMintingPrice(_id, _amount);
228:
229:   SafeERC20.safeTransferFrom(token, msg.sender, address(this), fee);

Consequently, this creates a vulnerability in indirect share participation with less payout, which may be considered unfair to other holders.

Proof of Concept

Assuming that Alice and Bob each hold some tokens for payment, and Bob has not participated in any shares:

1. The creator creates a new share, and let's assume the share ID is 1.
2. Alice purchases one share from Share ID 1 using her tokens via the buy function.
3. Alice mints a 1:1 ERC-1155 NFT corresponding to the purchased share.
4. Alice transfers the NFT to Bob by any method or reasoning, allowing Bob to become the owner of the NFT.
5. 💣 Bob, who does not currently hold any shares, decides to burn the NFT via the burnNFT function. In this process, he only pays the fee required to participate.

Consequence:

• By burning the NFT, Bob participates in Share ID 1, paying only the required fee, which is less than the normal cost of participation.

Resources

• PoC code: https://gist.github.com/filmptz/0b964a10eb481d28baeb39c6e23cf7e2
• The result of the test:

Tools Used

• Manual Review
• Foundry

Recommended Mitigation Steps

• If the intention is not to allow a mechanism for participants like Bob to access shares at a reduced price, consider applying the restriction that only the holders of the shares can call burnNFT.
• If the intention is to provide a mechanism for participants like Bob to access shares at a reduced price, carefully consider the fairness implications.

The recommendation should be considered in alignment with the project's business requirements, and any updates should be tested to ensure they meet the specific needs of the project.

Assessed type

Invalid Validation