MinterContract::lastMintDate Manipulation for Sales Option 3 in MinterContract::mint()

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/MinterContract.sol#L240-L253

Vulnerability details

Impact

The mint() function uses lastMintDate to limit mints to 1 per timePeriod for salesOption 3.

The logic controlling mint frequency for salesOption 3 relies solely on comparing the current timestamp to lastMintDate. This allows the rate limit to be bypassed by waiting longer than the timePeriod between mints.

By deliberately waiting longer than the timePeriod, an attacker can arbitrarily mint multiple NFTs without limit.

Proof of Concept

1. Set salesOption to 3
2. Call mint(), verified lastMintDate updated
3. Wait timePeriod + 1 second
4. Call mint() again, bypassing rate limit

       if (collectionPhases[col].salesOption == 3) {
            uint timeOfLastMint;
            if (lastMintDate[col] == 0) {
                // for public sale set the allowlist the same time as publicsale
                timeOfLastMint = collectionPhases[col].allowlistStartTime - collectionPhases[col].timePeriod;
            } else {
                timeOfLastMint =  lastMintDate[col];
            }
            // uint calculates if period has passed in order to allow minting
            uint tDiff = (block.timestamp - timeOfLastMint) / collectionPhases[col].timePeriod;
            // users are able to mint after a day passes
            require(tDiff>=1 && _numberOfTokens == 1, "1 mint/period");
            lastMintDate[col] = collectionPhases[col].allowlistStartTime + (collectionPhases[col].timePeriod * (gencore.viewCirSupply(col) - 1));
        }

Tools Used

Manual Review

Recommended Mitigation Steps

Add validation that time since last mint is less than timePeriod:

require(block.timestamp < lastMintDate + timePeriod)

Assessed type

Timing

[c4-pre-sort]

141345 marked the issue as duplicate of #688

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid