Submitted by bin2chen, also found by pauliax
https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/FixedPrice.sol#L110
https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/OpenEdition.sol#L122
After the contract is destroyed, the subsequent execution of the contracts #buy() will always succede, the msg.value will be locked in this address.
When FixedPrice.sol and OpenEdition.sol are finished, selfdestruct() will be executed to destroy the contract.
But there is a problem with this:
Suppose when Alice and Bob execute the purchase transaction at the same time, the transaction is in the memory pool (or Alice executes the transaction, but Bob is still operating the purchase in the UI, the UI does not know that the contract has been destroyed)
If Alice meets the finalId, the contract is destroyed after her transaction ends.
Note: When there is no code at the address, the transaction will succeed, and the msg.value will be stored in the contract. Although no code is executed.
After that, Bobs transaction will be executed.
This way the msg.value passed by Bob is lost and locked forever in the address of this empty code.
Suggestion: dont use selfdestruct, use modified state to represent that the contract has completed the sale.
berndartmueller (judge) commented:
stevennevins (Escher) disputed and commented:
berndartmueller (judge) commented:
