Missing check in the burnToMint function if the price was already set

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/MinterContract.sol#L256-L272

Vulnerability details

Summary

The burnToMint does not check if the price is already set with require(setMintingCosts[_collectionID] == true, "Set Minting Costs"); as the other mint functions do. Therefore, users are able to mint NFTs for free if price is not set yet.

Vulnerability Details

There are multiple functions to mint NFTs which correctly implement the check if the mint costs were already set:

function mint(uint256 _collectionID, uint256 _numberOfTokens, uint256 _maxAllowance, string memory _tokenData, address _mintTo, bytes32[] calldata merkleProof, address _delegator, uint256 _saltfun_o) public payable {
	  require(setMintingCosts[_collectionID] == true, "Set Minting Costs");
		...
}

function burnOrSwapExternalToMint(address _erc721Collection, uint256 _burnCollectionID, uint256 _tokenId, uint256 _mintCollectionID, string memory _tokenData, bytes32[] calldata merkleProof, uint256 _saltfun_o) public payable {
	  bytes32 externalCol = keccak256(abi.encodePacked(_erc721Collection,_burnCollectionID));
	  require(burnExternalToMintCollections[externalCol][_mintCollectionID] == true, "Initialize external burn");
	  require(setMintingCosts[_mintCollectionID] == true, "Set Minting Costs");
		...
}

The burnToMint function misses this check:

function burnToMint(uint256 _burnCollectionID, uint256 _tokenId, uint256 _mintCollectionID, uint256 _saltfun_o) public payable {
    require(burnToMintCollections[_burnCollectionID][_mintCollectionID] == true, "Initialize burn");
    require(block.timestamp >= collectionPhases[_mintCollectionID].publicStartTime && block.timestamp<=collectionPhases[_mintCollectionID].publicEndTime,"No minting");
    require ((_tokenId >= gencore.viewTokensIndexMin(_burnCollectionID)) && (_tokenId <= gencore.viewTokensIndexMax(_burnCollectionID)), "col/token id error");
    // minting new token
    uint256 collectionTokenMintIndex;
    collectionTokenMintIndex = gencore.viewTokensIndexMin(_mintCollectionID) + gencore.viewCirSupply(_mintCollectionID);
    require(collectionTokenMintIndex <= gencore.viewTokensIndexMax(_mintCollectionID), "No supply");
    require(msg.value >= getPrice(_mintCollectionID), "Wrong ETH");
    uint256 mintIndex = gencore.viewTokensIndexMin(_mintCollectionID) + gencore.viewCirSupply(_mintCollectionID);
    // burn and mint token
    address burner = msg.sender;
    gencore.burnToMint(mintIndex, _burnCollectionID, _tokenId, _mintCollectionID, _saltfun_o, burner);
    collectionTotalAmount[_mintCollectionID] = collectionTotalAmount[_mintCollectionID] + msg.value;
}

This allows users to mint NFTs for free between the time of setting the data for the NFT drop and setting the price, as the getPrice function call will return 0:

function getPrice(uint256 _collectionId) public view returns (uint256) {
    uint tDiff;
    if (collectionPhases[_collectionId].salesOption == 3) {
        ...
    } else if (collectionPhases[_collectionId].salesOption == 2 && block.timestamp > collectionPhases[_collectionId].allowlistStartTime && block.timestamp < collectionPhases[_collectionId].publicEndTime){
				...
    } else {
        // fixed price
        return collectionPhases[_collectionId].collectionMintCost;
    }
}

salesOption is not set and therefore takes the default value 0 of uin256 and therefore getPrice will return collectionMintCost which is also not set and takes the default value 0.

Impact

Users can mint NFTs for free and therefore steal funds from the artist and the protocol.

Tools Used

Manual Review

Recommendations

Check if the price was already set.

Assessed type

Invalid Validation

[c4-pre-sort]

141345 marked the issue as duplicate of #478

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1683

[c4-judge]

alex-ppg marked the issue as duplicate of #1866

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid