An attacker could enter the trickOrTreat
function for the rarest NFT with 0 wei. This would alwas revert unless he loses and has to pay double, then the transaction would go true and the NFT would be minted and the attacker comes in the pending list. Falsly increasing the tokenId and changing the perceived rarity of the NFT.
tickOrTreat
does not require any msg.value
sent when losing the game. This is also why only the transaction would go true when he loses the game.
Misleading Perception of Supply:
Users and potential buyers may observe a high nextTokenId and assume that many more NFTs have been minted than actually exist in circulation. This inflated perception can reduce the perceived exclusivity or rarity of each token, which is a critical factor in the valuation of NFTs. As perceived scarcity decreases, so might the perceived value of each NFT, potentially affecting market prices.
Negative Impact on Market Demand:
In the NFT market, buyers are often motivated by the rarity and uniqueness of assets. A perceived over-supply, even if inaccurate, can deter collectors and investors from engaging with the project. This could result in lower demand for new and existing tokens, reducing sales and transaction activity on the platform.
Reputation Risks:
NFT platforms and collections often rely on transparent and reliable metrics to build trust with users. If the inflated nextTokenId causes discrepancies between the reported and actual supply, it could harm the contract’s reputation. Users may lose trust in the platform’s ability to manage scarcity and fairness, leading to negative word-of-mouth and reluctance to engage with the platform.
Platform and Marketplace Misreporting:
Many marketplaces and analytics platforms use the nextTokenId to estimate the total supply of a collection. The inflated token count could lead to these platforms reporting a larger collection size than what truly exists, further exacerbating the perceived over-supply issue. This can mislead buyers across multiple platforms, compounding the negative effects on demand and value.
implement a require
statement at the beginning of the trickOrTreat
function (recommended)
add an if condition later in the trickOrTreat
function
The protocol can work correctly with more than 20000 tokens in it. It is informational.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.