NextGen - rishabh's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L218-L220

Vulnerability details

Impact

Cross Contract re-entrancy can occur due to not following CEI

Proof of Concept

1. Attacker can call burnToMint(), with any of the tokenId he owns!
2. This calls the burnToMint in GenCore, which mints the the new token from the to be minted collection.

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L218-L220

_mintProcessing(mintIndex, ownerOf(_tokenId), tokenData[_tokenId], _mintCollectionID, _saltfun_o);
// burn token
_burn(_tokenId);  

3. The issue that the protocol is minting the newToken and calling the receiver, without first burning the tokens. This allows the attacker to sell the tokens if it had liquidity and the token will get burned in the same transaction leading to the party who received token at the loss.

Tools Used

Recommended Mitigation Steps

Tokens should be burned before minting and calling the receiver contract, this follows the safe pattern

// burn token
_burn(_tokenId);  
_mintProcessing(mintIndex, ownerOf(_tokenId), tokenData[_tokenId], _mintCollectionID, _saltfun_o);

Assessed type

Reentrancy

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/XRandoms.sol#L28-L32

Vulnerability details

Impact

getWord() never returns the last element and returns the element at index 0 with twice the possibility compared to others

Proof of Concept

getWord function is called from inside randomWord

function randomWord() public view returns (string memory) {
        uint256 randomNum = uint(keccak256(abi.encodePacked(block.prevrandao, blockhash(block.number - 1), block.timestamp))) % 100;
        return getWord(randomNum);
    }

the value of randomNum always will remain between 0 <= randomNum < 100

But the getWord is implemented correctly for this value range

if (id==0) {
    return wordsList[id];
} else {
    return wordsList[id - 1];
}

Here is a relationship between randomNum variable and the output of getWord function

As it can be seen, wordsList[0] which is "Acai" will be returned twice and wordlist[99] which is "Watermelon" will never be returned.

Tools Used

Manual

Recommended Mitigation Steps

if (id==0) {
    return wordsList[id];
} else {
    return wordsList[id - 1];
}

Should be changed to

return wordList[id]

Assessed type

Other