Submitted by Trust, also found by gzeon
createPool() in GroupBuy.sol creates a new contribution pool around an NFT. It specifies a target \_initialPrice as minimum amount of ETH the NFT will cost, and \_totalSupply which is the number of Raes to be minted on purchase success.
minBidPrices is calculated from the two numbers. All future bids must be at least minBidPrices. It is assumed that if the totalSupply of Raes is filled up, the group will collect the initialPrice.
The issue is that division rounding error will make minBidPrices too low. Therefore, when all Raes are minted using minBidPrices price:
minBidPrices[currentId] * _totalSupply != _initialPrice
Therefore, not enough money has been collected to fund the purchase.
It can be assumed that most people will use minBidPrices to drive the price they will choose. Therefore, even after discovering that the Group has not raised enough after filling the supply pool, it will be very hard to get everyone to top up the contribution by a bit. This is because the settled price which is collected from all contributions is minReservePrices, which is always the minimum price deposited.
Code in contribute that updates minReservePrices:
The check in purchase() that we dont charge more than minReservePrices from each contribution:
We can see an important contract functionality is not working as expected which will impair NFT purchases.
GroupBuys that are completely filled still dont raise stated target amount.
Round the minBidPrices up, rather than down. It will ensure enough funds are collected.
HickupHH3 (judge) commented:
stevennevins (Tessera) confirmed and mitigated:
For this contest, 4 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by IllIllI received the top score from the judge.
The following wardens also submitted reports: gzeon,
cccz, and
Lambda
.
