There is a lack of checking the size of _tokmin and _tokmax

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L315-L322

Vulnerability details

Impact

If the input _tokmax is smaller than _tokmin, the require statement in the burnOrSwapExternalToMint function, require(_tokenId >= burnOrSwapIds[externalCol][0] && _tokenId <= burnOrSwapIds[externalCol][1], "Token id does not match");, will never pass.

Proof of Concept

@ function initializeExternalBurnOrSwap(address _erc721Collection, uint256 _burnCollectionID, uint256 _mintCollectionID, uint256 _tokmin, uint256 _tokmax, address _burnOrSwapAddress, bool _status) public FunctionAdminRequired(this.initializeExternalBurnOrSwap.selector) {
bytes32 externalCol = keccak256(abi.encodePacked(_erc721Collection,_burnCollectionID));
require((gencore.retrievewereDataAdded(_mintCollectionID) == true), "No data");
burnExternalToMintCollections[externalCol][_mintCollectionID] = _status;
burnOrSwapAddress[externalCol] = _burnOrSwapAddress;
@ burnOrSwapIds[externalCol][0] = _tokmin;
@ burnOrSwapIds[externalCol][1] = _tokmax;
}
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L315-L322

function burnOrSwapExternalToMint(address _erc721Collection, uint256 _burnCollectionID, uint256 _tokenId, uint256 _mintCollectionID, string memory _tokenData, bytes32[] calldata merkleProof, uint256 _saltfun_o) public payable {
    bytes32 externalCol = keccak256(abi.encodePacked(_erc721Collection,_burnCollectionID));
    require(burnExternalToMintCollections[externalCol][_mintCollectionID] == true, "Initialize external burn");
    require(setMintingCosts[_mintCollectionID] == true, "Set Minting Costs");
    address ownerOfToken = IERC721(_erc721Collection).ownerOf(_tokenId);
    if (msg.sender != ownerOfToken) {
        bool isAllowedToMint;
        isAllowedToMint = dmc.retrieveGlobalStatusOfDelegation(ownerOfToken, 0x8888888888888888888888888888888888888888, msg.sender, 1) || dmc.retrieveGlobalStatusOfDelegation(ownerOfToken, 0x8888888888888888888888888888888888888888, msg.sender, 2);
        if (isAllowedToMint == false) {
        isAllowedToMint = dmc.retrieveGlobalStatusOfDelegation(ownerOfToken, _erc721Collection, msg.sender, 1) || dmc.retrieveGlobalStatusOfDelegation(ownerOfToken, _erc721Collection, msg.sender, 2);    
        }
        require(isAllowedToMint == true, "No delegation");
    }

@ require(_tokenId >= burnOrSwapIds[externalCol][0] && _tokenId <= burnOrSwapIds[externalCol][1], "Token id does not match");
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L326C1-L339C132

Tools Used

Recommended Mitigation Steps

Add the corresponding check for this condition.

Assessed type

Context

[c4-sponsor]

a2rocket (sponsor) disputed

[a2rocket]

no need to add the check is unneccessary.

[c4-pre-sort]

141345 marked the issue as sufficient quality report

[alex-ppg]

The Warden specifies that an invalid ID burn range can be specified for external burn-to-mint collections.

The range can be simply reconfigured, rendering this submission to be a QA (NC) and thus of overinflated severity.

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Overinflated severity