NFT buyer can abuse the mompool and mint NFT of specific collection at lowest price

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L157-L166
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L170-L177
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L540-L563

Vulnerability details

Impact

NFT buyer can abuse the mompool and mint NFT of specific collection at lowest price.

Proof of Concept

• Admin (for example a collectionAdmin or a functionAdmin) calls setCollectionData.
• Bob is tracking the mempool and see which parameters are set for collection#1 (for example he see _collectionTotalSupply and maxCollectionPurchases).
• Admin calls setCollectionCosts and sets the minting costs for collection#1.
• Bob see which parameters are set for collection#1 (for example rate, timeperiod, salesOption)
• Admin calls setCollectionPhases and sets collection timing for collection#1 (phases).
• Bob also see which timing is set for collection#1 (for example he see allowlistStartTime and publicEndTime).
• Bob will wait until the minting starts.

Now imagine salesOption is 2, and timestamp is between allowStartTime and publicEndTime, so Bob knows in this case the price is decreasing during time (see MinterContract#getPrice() function), and also he knows how much supply is available (totalSupply minus circulatingSupply) and also he knows how many NFTs can be minted per address (because Bob knows maxCollectionPurchases), he waits until other people have bought all the others NFTs and he buys the latest NFTs at lowest price.

Another situation that can be assumed is that a a lot of users are familiar with this scenario and all of them will wait until the price is as low as possible (when we approach to the publicEndTime, we realize that the price has reached its lowest price).

Tools Used

Manual Review

Recommended Mitigation Steps

Consider adding a workaround which prevents against this scenraio, but here i suggest a workaround that maybe useful:
If one of the parameters being invisible (making variable private rather than public), no one is able to abuse this scenario.

Assessed type

Other

[c4-pre-sort]

141345 marked the issue as duplicate of #478

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as insufficient quality report

[alex-ppg]

The Warden specifies a situation whereby a savvy buyer can wait until a collection's supply is close to exhaustion in a price-decreasing model to purchase it close to the end for a profit which aligns with the project's specification.

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid