User may get a bad price when minting in a Descending Sale

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L540

Vulnerability details

Impact

At each time period of a Descending Sale, the minting cost decreases exponentially or linearly until it reaches its resting price (ending minting cost) and stays there until the end of the minting phase. However, user may get a price at collectionMintCost (starting price) when minting in a Descending Sale if the token is minted at the end of the sale period.

Proof of Concept

User can mint collection item during the public sale period:

        } else if (block.timestamp >= collectionPhases[col].publicStartTime && block.timestamp <= collectionPhases[col].publicEndTime) {

When getting the minting price of collection, protocol will first check salesOption, if salesOption is 2 (Descending Sale), then protocol compares block.timestamp with publicEndTime.

Only if block.timestamp is less than publicEndTime, protocol will calculate the minting price based on Descending Sale Model:

        } else if (collectionPhases[_collectionId].salesOption == 2 && block.timestamp > collectionPhases[_collectionId].allowlistStartTime && block.timestamp < collectionPhases[_collectionId].publicEndTime){

If block.timestamp is equal to publicEndTime, the minting price will be collectionMintCost, which would be much higher than collectionEndMintCost:

        } else {
            // fixed price
            return collectionPhases[_collectionId].collectionMintCost;
        }

Please see below test case and run it in nextGen.test.js:

it("#getPriceCol4AtPulicEndTime", async function() {
      await time.increaseTo(1796931278)
      const price = await contracts.hhMinter.getPrice(
        4, // _collectionID
      )

      expect(parseInt(price)).equal(1000000000000000000);
    })

It may not seems like a high chance that the token is minted at publicEndTime, however, it's still likely to happen if the collection is very popular and many user want to buy it.

Tools Used

Manual Review

Recommended Mitigation Steps

Protocol should calculate the minting price based on Descending Sale Model, when block.timestamp is less than or equal to publicEndTime:

-       } else if (collectionPhases[_collectionId].salesOption == 2 && block.timestamp > collectionPhases[_collectionId].allowlistStartTime && block.timestamp < collectionPhases[_collectionId].publicEndTime){

+       } else if (collectionPhases[_collectionId].salesOption == 2 && block.timestamp > collectionPhases[_collectionId].allowlistStartTime && block.timestamp <= collectionPhases[_collectionId].publicEndTime){

Assessed type

Context

[c4-pre-sort]

141345 marked the issue as duplicate of #1391

[c4-judge]

alex-ppg marked the issue as partial-50