Canto Application Specific Dollars and Bonding Curves for 1155s - sbaudh6's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L197

Vulnerability details

Hello Team,

Summary :

I would like to report an issue in smart contract [Market.sol] in which developer miss to a check a correct Logical check due to which a minor accounting issue will occur due to which getNFTMintingPrice() function functionality is in Doubt

Means , if the Numerator value is Less then Denominator then Overall Fee we pay = ZERO

Exact Issue :

Step 1 : Open the Link = https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L197

Step 2 : At Line 197 Here you see a function like this ;

          function getNFTMintingPrice(uint256 _id, uint256 _amount) public view returns (uint256 fee) {
    address bondingCurve = shareData[_id].bondingCurve;
    (uint256 priceForOne, ) = IBondingCurve(bondingCurve).getPriceAndFee(shareData[_id].tokenCount, 1);
    fee = (priceForOne * _amount * NFT_FEE_BPS) / 10_000;
}

Step 3 : Here In the Code : ( Since Visibility of this Function is PUBLIC)

              fee = (priceForOne * _amount * NFT_FEE_BPS) / 10_000;

Step 4 :

  NFT_FEE_BPS  = 1000
  _amount           =  4
  priceForOne     = 2

then Overall Output will be :

         fee =  ( 2 * 4 * 1000) / 10000

                =  8000 / 10000

           fee  = 0 

Impact :

1. User have an ability to mint an NFT with paying ZERO Fee.

2. Violation of secure code design principles.

Recommendation :

Recommend developer to impose a strict security check so that Numerator >= Denominator .

 function getNFTMintingPrice(uint256 _id, uint256 _amount) public view returns (uint256 fee) {
    address bondingCurve = shareData[_id].bondingCurve;
    (uint256 priceForOne, ) = IBondingCurve(bondingCurve).getPriceAndFee(shareData[_id].tokenCount, 1);
     require( (priceForOne * _amount * NFT_FEE_BPS) >= 10000);
     fee = (priceForOne * _amount * NFT_FEE_BPS) / 10_000;
   }


         

Assessed type

Math