mintAndAuction can't be called for collections that are using sales model 1

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/hardhat/smart-contracts/MinterContract.sol#L292

Vulnerability details

Impact

mintAndAuction allows admins to mint a token, in a collection, per period and then start an auction on it. This ability should always be available to admins, regardless of the sales model used by the collection.

From the docs:

Fixed Price Sale
The minting cost is fixed during the minting phase. The rate and time period need to be set to 0 as they do not affect the price.

So if a collection is using sales model 1, the timePeriod should be set to 0. When mintAndAuction is called on a collection that uses sales model 1, it will revert on uint tDiff = (block.timestamp - timeOfLastMint) / collectionPhases[_collectionID].timePeriod; as it will be diving by 0. Blocking admins from the ability to "mint and auction".

Proof of Concept

context("my context", async () => {
  let globalCollectionId = 1;

  it("bug", async () => {
    // Helpers //
    const {
      hhCore: NextGenCore,
      hhAdmin: NextGenAdmins,
      hhMinter: Minter,
      hhRandomizer: Randomizer,
      hhAuction: Auction,
    } = contracts;
    const { owner, addr1: bob, addr2: alice, addr3: greg } = signers;
    const _1ETH = BigInt(1000000000000000000);
    const _0_1ETH = BigInt(100000000000000000);
    const _0_2ETH = BigInt(200000000000000000);
    const _0_3ETH = BigInt(300000000000000000);

    const now = async () => {
      return (await ethers.provider.getBlock()).timestamp;
    };

    const createCollection = async (collectionAdmin, maxSupply) => {
      const collectionID = globalCollectionId++;
      await NextGenCore.connect(owner).createCollection(
        `Test Collection ${collectionID}`,
        `Artist ${collectionID}`,
        "For testing",
        "www.test.com",
        "CCO",
        "https://ipfs.io/ipfs/hash/",
        "",
        ["desc"],
      );
      await NextGenAdmins.connect(owner).registerCollectionAdmin(collectionID, collectionAdmin.address, true);
      await NextGenCore.connect(collectionAdmin).setCollectionData(
        collectionID, // _collectionID
        collectionAdmin.address, // _collectionArtistAddress
        3, // _maxCollectionPurchases
        maxSupply, // _collectionTotalSupply
        0, // _setFinalSupplyTimeAfterMint
      );
      await Minter.connect(collectionAdmin).setCollectionCosts(
        collectionID, // _collectionID
        _1ETH, // _collectionMintCost 1 eth
        _0_1ETH, // _collectionEndMintCost 0.1 eth
        0, // _rate
        0, // _timePeriod
        1, // _salesOptions
        collectionAdmin.address, // delAddress
      );
      await Minter.connect(collectionAdmin).setCollectionPhases(
        collectionID, // _collectionID
        await now(), // _allowlistStartTime
        (await now()) + 10000, // _allowlistEndTime
        await now(), // _publicStartTime
        (await now()) + 10000, // _publicEndTime
        "0x8e3c1713145650ce646f7eccd42c4541ecee8f07040fc1ac36fe071bbfebb870", // _merkleRoot
      );
      await NextGenCore.addRandomizer(collectionID, Randomizer);
      return collectionID;
    };

    // Actual test //
    await NextGenCore.connect(owner).addMinterContract(Minter.target);

    const bobCollectionId = await createCollection(bob, 5);

    await expect(Minter.connect(owner).mintAndAuction(
      owner.address,
      '{"tdh": "100"}',
      2,
      bobCollectionId,
      (await now()) + 10000,
    )).to.be.reverted;
  })
})

Tools Used

Manual review + vscode

Recommended Mitigation Steps

Have a fallback time period or make collection time period a require (>0) parameter.

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as duplicate of #1278

[c4-pre-sort]

141345 marked the issue as duplicate of #962

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #1278

[c4-judge]

alex-ppg marked the issue as duplicate of #1980

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Overinflated severity