Check missing for _publicStartTime > _allowlistEndTime in NextGenMinterContract

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/hardhat/smart-contracts/MinterContract.sol#L170-L177

Vulnerability details

Summary

There is a missing check in setCollectionPhases(). If provided _publicStartTime <= _allowlistEndTime then the transaction mint() & burnOrSwapExternalToMint() will revert for public minters.

Vulnerability Details

If the _publicStartTime <= _allowlistEndTime then all the users who try to mint() or burnOrSwapExternalToMint() for public sale will fail as the handling is not done properly.

Impact

The public minters will not be able to mint until _publicStartTime > _allowlistEndTime.

Recommendations

Add _publicStartTime > _allowlistEndTime check in setCollectionPhases()

function setCollectionPhases(uint256 _collectionID, uint _allowlistStartTime, uint _allowlistEndTime, uint _publicStartTime, uint _publicEndTime, bytes32 _merkleRoot) public CollectionAdminRequired(_collectionID, this.setCollectionPhases.selector) {
         require(setMintingCosts[_collectionID] == true, "Set Minting Costs");
+        if(_publicStartTime <= _allowlistEndTime) {
+            revert("invalid inputs");
+        }
         collectionPhases[_collectionID].allowlistStartTime = _allowlistStartTime;
         collectionPhases[_collectionID].allowlistEndTime = _allowlistEndTime;

Assessed type

Invalid Validation

[c4-pre-sort]

141345 marked the issue as duplicate of #1274

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #478

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #2033

[c4-judge]

alex-ppg changed the severity to QA (Quality Assurance)

[c4-judge]

alex-ppg marked the issue as grade-c