Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

User can revert the trickOrTreat until he is lucky to receive the NFT for half the price

cryptozaki

Summary

The caller of the function trickOrTreatcan be an external contract which can revert the transaction until he is lucky enough to mint the NFT for half the price.

Vulnerability Details

The problem lies in the last few lines of the function treatOrTrick

// Refund excess ETH if any
if (msg.value > requiredCost) {
uint256 refund = msg.value - requiredCost;
(bool refundSuccess, ) = msg.sender.call{value: refund}("");
require(refundSuccess, "Refund failed");
}

If the sender is an external contract, it can revert the transaction until it gets the NFT for half the price. It will pay gas fees, but may receive really expensive NFT for 1/2 of the price.

Impact

The impact is that someone can receive really valuable NFT for much cheaper

Tools Used

foundry

Recommendations

Create separate function for example refundExcessETHwhich the users can call after they successfully minted the NFT.

Move the aforementioned lines there.

Updates

Appeal created

bube Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.