The setCollectionPhases function did not check the size of allowlistStartTime and allowlistEndTime.

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L170-L177

Vulnerability details

Impact

allowlistEndTime should be greater than allowlistStartTime, and publicEndTime should be greater than publicStartTime.Otherwise, an error will occur.

Proof of Concept

function setCollectionPhases(uint256 _collectionID, uint _allowlistStartTime, uint _allowlistEndTime, uint _publicStartTime, uint _publicEndTime, bytes32 _merkleRoot) public CollectionAdminRequired(_collectionID, this.setCollectionPhases.selector) {
    require(setMintingCosts[_collectionID] == true, "Set Minting Costs");
    collectionPhases[_collectionID].allowlistStartTime = _allowlistStartTime;
    collectionPhases[_collectionID].allowlistEndTime = _allowlistEndTime;
    collectionPhases[_collectionID].merkleRoot = _merkleRoot;
    collectionPhases[_collectionID].publicStartTime = _publicStartTime;
    collectionPhases[_collectionID].publicEndTime = _publicEndTime;
}

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L170-L177

Tools Used

Recommended Mitigation Steps

add check

Assessed type

Context

[c4-pre-sort]

141345 marked the issue as duplicate of #1274

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #478

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #2033

[c4-judge]

alex-ppg changed the severity to QA (Quality Assurance)

[c4-judge]

alex-ppg marked the issue as grade-c