mint/airdroptokens function can be DOSed.

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/MinterContract.sol#L223

Vulnerability details

Proof of Concept

Unbounded array i.e there is no limit in gencore.viewMaxAllowance. In nextgencore contract, when one set maxcollectionpurchase , there is no boundation.

So the problem is when one mint more tokenids in one transaction as maxcollectionpurchase may be a high number, the transaction may DOS.

function airDropTokens may also DOS as _numberOfTokens[ ] is an unbounded array.

Impact

Users may lose gas costs.

Tools Used

manual review

Recommended Mitigation Steps

bound/limit both maxcollectionpurchase and _numberOfTokens

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as sufficient quality report

[c4-pre-sort]

141345 marked the issue as insufficient quality report

[alex-ppg]

The Warden specifies potential DoS concerns, however, they fail to weaponize them or articulate why they should be considered vulnerabilities in an acceptable manner.

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Insufficient quality

[alex-ppg]

Multiple findings of the Warden have been deemed invalid and as such, I will group any further findings I find invalid here without providing a rationale in compliance with the relevant SC guidelines.

[c4-judge]

alex-ppg marked the issue as primary issue