getPrice may return the wrong price

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L540

Vulnerability details

Impact

block.timestamp = collectionPhases.allowlistStartTime
|| block.timestamp = collectionPhases.publicEndTime

getPrice returns the wrong price

Proof of Concept

When salesOption==2 in the getPrice function, there is no case where the time is equal to the start/end time.

When block.timestamp is equal to allowlistStartTime or publicEndTime, the default price is returned instead of the price over time.

It may be correct to return the default time for allowlistStartTime, but it is wrong to return the default price for publicEndTime.

function getPrice(uint256 _collectionId) public view returns (uint256) {
    ....
    } else if (
        collectionPhases[_collectionId].salesOption == 2 &&
        //@audit missing =
        block.timestamp > collectionPhases[_collectionId].allowlistStartTime &&
        block.timestamp < collectionPhases[_collectionId].publicEndTime
    )

In NextGenMinterContract#mint the judgment of time is: >= <=
So when block.timestamp = publicEndTime/allowlistStartTime, the mint parameter is set correctly.

function mint(
        uint256 _collectionID,
        uint256 _numberOfTokens,
        uint256 _maxAllowance,
        string memory _tokenData,
        address _mintTo,
        bytes32[] calldata merkleProof,
        address _delegator,
        uint256 _saltfun_o
    ) public payable {
        ....
        if (
            block.timestamp >= collectionPhases[col].allowlistStartTime &&
            block.timestamp <= collectionPhases[col].allowlistEndTime
        ) {
        ....
        } else if (
            block.timestamp >= collectionPhases[col].publicStartTime &&
            block.timestamp <= collectionPhases[col].publicEndTime
        ) {
        ....
        require(msg.value >= (getPrice(col) * _numberOfTokens), "Wrong ETH");
        for (uint256 i = 0; i < _numberOfTokens; i++) {
            uint256 mintIndex = gencore.viewTokensIndexMin(col) + gencore.viewCirSupply(col);
            gencore.mint(
                mintIndex,
                mintingAddress,
                _mintTo,
                tokData,
                _saltfun_o,
                col,
                phase
            );
        }
        ....

Tools Used

vscode manual

Recommended Mitigation Steps

    function getPrice(uint256 _collectionId) public view returns (uint256) {
        ....
     } else if (
            collectionPhases[_collectionId].salesOption == 2 &&
            block.timestamp >= collectionPhases[_collectionId].allowlistStartTime &&
            block.timestamp <= collectionPhases[_collectionId].publicEndTime
        )

Assessed type

Other

[c4-pre-sort]

141345 marked the issue as primary issue

[c4-sponsor]

a2rocket (sponsor) confirmed

[c4-pre-sort]

141345 marked the issue as sufficient quality report

[c4-judge]

alex-ppg marked issue #1275 as primary and marked this issue as a duplicate of 1275

[c4-judge]

alex-ppg marked the issue as partial-50