The setCollectionPhases function is missing validations for StartTime and EndTime

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L170-L177

Vulnerability details

Impact

The Collection Phases timings can be mistakenly or maliciously set to incorrect timestamps, potentially preventing users' participation in the sale phases.

Proof of Concept

The setCollectionPhases function in the MinterContract.sol contract enables a collection admin to define sale phases for a _collectionId, setting parameters such as _allowlistStartTime, _allowlistEndTime, _publicStartTime, and _publicEndTime.

However, there is currently no validation check to ensure that _allowlistEndTime > _allowlistStartTime and _publicEndTime > _publicStartTime. This absence of validation allows the collection admin to unintentionally or intentionally (maliciously) input invalid values, potentially preventing a sale from occurring.

Furthermore, there is no verification that _publicStartTime >= block.timestamp and _allowlistStartTime >= block.timestamp. If startTime > endTime or startTime < block.timestamp, the sale would be rendered unable to start, impeding users from minting tokens.

Tools Used

VSCode

Recommended Mitigation Steps

Add the following require statements to the setCollectionPhases() function:

require(_publicStartTime <= (_publicEndTime && (_publicStartTime >= block.timestamp, "wrong allowlist time")

require(_allowlistStartTime <= _allowlistEndTime && _allowlistStartTime >= block.timestamp, "wrong allowlist time")

These statements ensure that the specified start and end times for both public and allowlist sales are valid, preventing incorrect configurations that could impact the sale phases.

Assessed type

Invalid Validation

[c4-pre-sort]

141345 marked the issue as duplicate of #478

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #2033

[c4-judge]

alex-ppg changed the severity to QA (Quality Assurance)

[c4-judge]

alex-ppg marked the issue as grade-c