Art Gobblers contest - yixxas's results

Lines of code

https://github.com/code-423n4/2022-09-artgobblers/blob/d2087c5a8a6a4f1b9784520e7fe75afa3a9cbdbe/src/ArtGobblers.sol#L411

Vulnerability details

Impact

Legendary gobbler cannot be minted when the cost of minting is too high. In mintLegendaryGobbler() function, loop is run through all the gobblers used for the sacrifice. This is an expensive gas operation when cost is too high. In this case, it will exceed the block gas limit of 30 million gas when a user is attempting to mint the last legendary gobbler.

ArtGobblers.sol#L411

    function mintLegendaryGobbler(uint256[] calldata gobblerIds) external returns (uint256 gobblerId) {
            ...

            uint256 id; // Storing outside the loop saves ~7 gas per iteration.

            for (uint256 i = 0; i < cost; ++i) {
                id = gobblerIds[i];

                if (id >= FIRST_LEGENDARY_GOBBLER_ID) revert CannotBurnLegendary(id);

                require(getGobblerData[id].owner == msg.sender, "WRONG_FROM");

                burnedMultipleTotal += getGobblerData[id].emissionMultiple;

                emit Transfer(msg.sender, getGobblerData[id].owner = address(0), id);
            }
    ...
    }

Proof of Concept

LEGENDARY_SUPPLY = 10 LEGENDARY_GOBBLER_INITIAL_START_PRICE = 69 gobblers

The cost doubles for each subsequent ones so we have, in the final iteration, cost = 69 * 2**10 = 70656 so gobblerIds[].length = 70656 and foundry gas estimation to call mintLegendaryGobblers(gobblerIds[]) is at the cost of 35 million gas > 30 million gas.

Minters will have to wait till the cost drops below some amount such that the block gas limit is not exceeded.

Tools Used

Foundry

Recommended Mitigation Steps

I see no simple fix for this without compromising on the cost increase of legendary gobblers or the starting cost since every gobblers sacrificed need to be looped through to check their validity and emissions.