Wrong economics mechanism in the function getPrice.

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/MinterContract.sol#L536

Vulnerability details

Proof of Concept

If collectionphase is 3 and rate is greater than 0 then, the mint cost increases if collectonid’s tokenids supply/demand increase. If rate is 0 then, mintcost does not increases/decreses.

return collectionPhases[_collectionId].collectionMintCost + ((collectionPhases[_collectionId].collectionMintCost / collectionPhases[_collectionId].rate) * gencore.viewCirSupply(_collectionId));

So the problem is that minting cost incrases if collectionid’s tokenids supply increases but minting cost does not decrease if tokenid supply decreases(if the collectionid’s tokenids are burned).
This is an economically wrong mechanism because price is increased based on tokendis supply/demand but price is not decreased based on supply/demand.

Let's take an example,let assume a collectionid’s total minted tokens are 10. So minting cost will increase based on the 10 tokenids. Now 4 tokenids are burned, so minting cost should be based on the remaining 6 tokenids. but the problem is codes still calculate minting cost based on 10 tokenids.

Impact

Users will be charged more minting cost than fair prices.

Tools Used

manual review

Recommended Mitigation Steps

When multiplying totalsupply of tokenids, instead of multiplying gencore.viewCirSupply(_collectionId), multiply by gencore.totalSupplyOfCollection( _collectionID).

Assessed type

Context

[c4-pre-sort]

141345 marked the issue as duplicate of #469

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as sufficient quality report

[c4-pre-sort]

141345 marked the issue as primary issue

[c4-sponsor]

a2rocket (sponsor) disputed

[a2rocket]

this is the intended design, burnt tokens are not removed from the circulating supply and this is correct. If the total supply is 100 and the circulating supply is 100 it mints that the collection is fully funded. If someone wants to burn its token this does not mean that someone can mint it. If someone burns the token then the total supply = circulatingSupply - burntSupply. We have a function for this on the Core contract. With this logic the price should not decrease if someone burnt a token before minting ends.

[c4-judge]

alex-ppg marked the issue as duplicate of #644

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid