Forgotten Runes Warrior Guild contest - rajatbeladiya's results

16,000 Warrior NFTs sold in a phased Dutch Auction.

General Information

Platform: Code4rena

Start Date: 03/05/2022

Pot Size: $30,000 USDC

Total HM: 6

Participants: 93

Period: 3 days

Judge: gzeon

Id: 118

League: ETH

Forgotten Runes

Findings Distribution

Researcher Performance

Rank: 28/93

Findings: 3

Award: $292.27

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: Kulk0

Also found by: 0x1f8b, 0xDjango, BowTiedWardens, Dinddle, broccolirob, defsec, dirk_y, hyh, rajatbeladiya, throttle, unforgiven

Labels

bug
duplicate
2 (Med Risk)
sponsor acknowledged

Awards

246.5367 USDC - $246.54

External Links

Lines of code

https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L257-L262 https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L97 https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L104 https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L201-L223 https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L229-L250

Vulnerability details

Impact

teamSummon can mint nfts in any phase and no minted nfts states maintained for team. maxForSale is 14190 ( including dutch auction, phase 2, phase 3 ) and maxForClaim is 1100 ( phase 4 ). If team mint 2000 nfts till phase 2 and along with it number of sales reaches 14000, no one will be able to mint or claim nfts even if conditions will be satisfied for phase 3 and phase 4.

Proof of Concept

https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L257-L262

https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L97

https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L104

https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L201-L223

https://github.com/code-423n4/2022-05-runes/blob/060b4f82b79c8308fe65674a39a07c44fa586cd3/contracts/ForgottenRunesWarriorsMinter.sol#L229-L250

Tools Used

Manual Analysis

it should set nfts mint limit to 710 for team till all phases are completed. Once all phases are completed, team should mint remaining nfts.

#0 - wagmiwiz

2022-05-05T09:42:28Z

This is partly true, but by design. It's a risk for minters, but it would be obvious, so we're economically disincentivized to do this.

It also helps with the case where we don't end up with everyone claiming their free nfts in the claim phase.

Acknowledged, but not changing it.

#1 - KenzoAgada

2022-06-06T05:43:32Z

Duplicate of #104.

Sale should start with its time

Use,

block.timestamp >= daStartTime; block.timestamp >= publicStartTime; block.timestamp >= claimsStartTime;

Instead of,

block.timestamp > daStartTime; block.timestamp > publicStartTime; block.timestamp > claimsStartTime;

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter