NFT flashloans can bypass sale constraints

[code423n4]

Handle

pauliax

Vulnerability details

Impact

Public sale has a constraint that for the first 4 weeks only NFT holders can access the sale:
if (currentEra < firstPublicEra) {
require(nft.balanceOf(msg.sender) > 0, "You need NFT to participate in the sale.");
}

However, this check can be easily bypassed with the help of flash loans. You can borrow the NFT, participate in the sale and then return this NFT in one transaction. It takes only 1 NFT that could be flashloaned again and again to give access to the sale for everyone (burnEtherForMember).

Recommended Mitigation Steps

I am not sure what could be the most elegant solution to this problem. You may consider transferring and locking this NFT for at least 1 block but then the user will need to do an extra tx to retrieve it back. You may consider taking a snapshot of user balances so the same NFT can be used by one address only but then this NFT will lose its extra benefit of selling it during the pre-sale when it acts as a pre-sale token. You may consider checking that the caller is EOA but again there are ways to bypass that too.