Math error in getPrice when sale option is 2

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/2467db02cc446374ab9154dde98f7e931d71584d/smart-contracts/MinterContract.sol#L540-L551

Vulnerability details

Impact

Math error in getPrice when sale option is 2, get price return wrong value.

Proof of Concept

When saleoption is 2 and rate is 0,let's take a look at this calcution.

decreaserate = ((price - (collectionPhases[_collectionId].collectionMintCost / (tDiff + 2))) / collectionPhases[_collectionId].timePeriod) * ((block.timestamp - (tDiff * collectionPhases[_collectionId].timePeriod) - collectionPhases[_collectionId].allowlistStartTime));

I try to simplify this formula.

Fist,we set some values:

tDiff = （block.timestamp  - starttime）/ timeperiod ; 
price1=  mintcost/ (tDiff +1)
price2=  mintcost/ (tDiff +2)

Now we look at this formula.

  decreaserate = (price1 - price2) / timeperiod * (block.timestamp - (x*timeperiod) - starttime)

  decreaserate =  (price1 - price2) / timeperiod * ( block.timestamp - (block.timestamp - starttime) - starttime)
 
  decreaserate =  (price1 - price2) / timeperiod * ( (block.timestamp - starttime) - (block.timestamp-starttime))
  
  decreaserate = (price1 - price2) / timeperiod * 0 
                =0

decreaserate is always 0 and price will not change.

Poc:
logs: notice price at end and current will not change

    Get Price decrease
    currentTime 1699348138
    priceAtStart 100000000000000000
    priceAtEnd 1000000000000000000
      ✔ #Get Price decrease (309ms)

crate a new file and paste it

const {
  loadFixture,time
} = require("@nomicfoundation/hardhat-toolbox/network-helpers")
const { expect } = require("chai")
const { ethers } = require("hardhat")
const fixturesDeployment = require("../scripts/fixturesDeployment.js")

let signers
let contracts

describe("NextGen Tests", function () {
  before(async function () {
    ;({signers, contracts} = await loadFixture(fixturesDeployment))
  })

  context("Get Price decrease", () => {

    // npx hardhat test test/test_coll3.js
    it.only("#Get Price decrease", async function () {

      await setEnviorment();

      const price = await contracts.hhMinter.getPrice(
          4, // _collectionID
      )
      //current time
      const currentTime = await time.latest();
      console.log("currentTime",currentTime.toString());
      const priceAtCurrent = await contracts.hhMinter.getPrice(
          4, // _collectionID
      )
      console.log("priceAtCurrent",priceAtCurrent.toString());
      //_publicEndTime
      await time.increaseTo(1796931278)
      const priceAtEnd = await contracts.hhMinter.getPrice(
          4, // _collectionID
      )
      console.log("priceAtEnd",priceAtEnd.toString());
    })
  })



  async function setEnviorment() {1
    await contracts.hhCore.createCollection(
        "Test Collection 1",
        "Artist 1",
        "For testing",
        "www.test.com",
        "CCO",
        "https://ipfs.io/ipfs/hash/",
        "",
        ["desc"],
    )

    await contracts.hhCore.createCollection(
        "Test Collection 2",
        "Artist 2",
        "For testing",
        "www.test.com",
        "CCO",
        "https://ipfs.io/ipfs/hash/",
        "",
        ["desc"],
    )

    await contracts.hhCore.createCollection(
        "Test Collection 3",
        "Artist 3",
        "For testing",
        "www.test.com",
        "CCO",
        "https://ipfs.io/ipfs/hash/",
        "",
        ["desc"],
    )

    await contracts.hhCore.createCollection(
        "Test Collection 4",
        "Artist 4",
        "For testing",
        "www.test.com",
        "CCO",
        "https://ipfs.io/ipfs/hash/",
        "",
        ["desc"],
    )

    await contracts.hhAdmin.registerCollectionAdmin(
        1,
        signers.addr1.address,
        true,
    )

    await contracts.hhAdmin.registerCollectionAdmin(
        3,
        signers.addr1.address,
        true,
    )


    await contracts.hhCore.connect(signers.addr1).setCollectionData(
        1, // _collectionID
        signers.addr1.address, // _collectionArtistAddress
        2, // _maxCollectionPurchases
        10000, // _collectionTotalSupply
        0, // _setFinalSupplyTimeAfterMint
    )


    await contracts.hhCore.setCollectionData(
        2, // _collectionID
        signers.addr1.address, // _collectionArtistAddress
        1, // _maxCollectionPurchases
        100, // _collectionTotalSupply
        1000, // _setFinalSupplyTimeAfterMint
    )


    //
    await contracts.hhCore.setCollectionData(
        3, // _collectionID
        signers.addr1.address, // _collectionArtistAddress
        1, // _maxCollectionPurchases
        100, // _collectionTotalSupply
        1000, // _setFinalSupplyTimeAfterMint
    )

    await contracts.hhCore.setCollectionData(
        4, // _collectionID
        signers.addr1.address, // _collectionArtistAddress
        1, // _maxCollectionPurchases
        50, // _collectionTotalSupply
        200, // _setFinalSupplyTimeAfterMint
    )

    await contracts.hhCore.addMinterContract(
        contracts.hhMinter,
    )

    await contracts.hhCore.addRandomizer(
        2, contracts.hhRandomizer,
    )

    await contracts.hhCore.addRandomizer(
        3, contracts.hhRandomizer,
    )

    await contracts.hhCore.addRandomizer(
        5, contracts.hhRandomizer,
    )

    await contracts.hhMinter.setCollectionCosts(
        2, // _collectionID
        BigInt(1000000000000000000), // _collectionMintCost 1 eth
        BigInt(100000000000000000), // _collectionEndMintCost 0.1 eth
        BigInt(100000000000000000), // _rate
        200, // _timePeriod
        2, // _salesOptions
        '0xD7ACd2a9FD159E69Bb102A1ca21C9a3e3A5F771B', // delAddress
    )
    await contracts.hhMinter.setCollectionPhases(
        2, // _collectionID
        1698138500, // _allowlistStartTime
        1698138500, // _allowlistEndTime
        1698138500, // _publicStartTime
        1796931278, // _publicEndTime
        "0x8e3c1713145650ce646f7eccd42c4541ecee8f07040fc1ac36fe071bbfebb870", // _merkleRoot
    )
    await contracts.hhMinter.setCollectionCosts(
        4, // _collectionID
        BigInt(1000000000000000000), // _collectionMintCost 1 eth
        BigInt(100000000000000000), // _collectionEndMintCost 0.1 eth
        0, // _rate
        200, // _timePeriod
        2, // _salesOptions
        '0xD7ACd2a9FD159E69Bb102A1ca21C9a3e3A5F771B', // delAddress
    )

    await contracts.hhMinter.setCollectionPhases(
        4, // _collectionID
        1698138900, // _allowlistStartTime
        1698138900, // _allowlistEndTime
        1698138900, // _publicStartTime
        1796931278, // _publicEndTime
        "0x8e3c1713145650ce646f7eccd42c4541ecee8f07040fc1ac36fe071bbfebb870", // _merkleRoot
    )
  }

})

Tools Used

hardhat

Recommended Mitigation Steps

modify formula

Assessed type

Math

[c4-pre-sort]

141345 marked the issue as sufficient quality report

[c4-pre-sort]

141345 marked the issue as duplicate of #643

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-sponsor]

a2rocket (sponsor) disputed

[c4-judge]

alex-ppg marked the issue as duplicate of #746

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid