Incorrect computation allows cheaper mints in periodic sale

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L536

Vulnerability details

Impact

The idea behind the third sale model, periodic sale, is that for each new minted NFT, the price increases with a given % of the initial price. This % is the _rate parameter in the MinterContract.setCollectionCosts() function. MinterContract.getPrice() calculates the price incorrectly. Let's have a look:

return collectionPhases[_collectionId].collectionMintCost + ((collectionPhases[_collectionId].collectionMintCost / collectionPhases[_collectionId].rate) * gencore.viewCirSupply(_collectionId));

It divides the initial mint cost by the rate. So if the rate is 20%, the new price will become initialPrice / 20, which is actually 5% increase and not 20%. This lets users mint NFTs for significantly less money.

Proof of Concept

Let's look at the following case:

mintCost	1 ETH
rate	20%
mints	5

Expected mint price	Actual mint price
1 ETH	1 ETH
1.2 ETH	1.05 ETH
1.4 ETH	1.1 ETH
1.6 ETH	1.15 ETH
1.8 ETH	1.20 ETH

As a result we have minted 5 NFTs for 5.5 ETH, not for 7 ETH. Here is a PoC in Foundry:

Proof of Concept

1. Create foundry folder and install Foundry inside of it.
2. Add remappings to map smart-contracts to contracts relative to the needed path.
3. Add the following PoC.
4. Run

forge test --lib-paths ../smart-contracts

Tools Used

Foundry

Recommended Mitigation Steps

Instead of dividing the mint cost by rate, multiply it by rate and then divide by 100.

Assessed type

Math

[c4-pre-sort]

141345 marked the issue as sufficient quality report

[c4-pre-sort]

141345 marked the issue as duplicate of #643

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #641

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Overinflated severity