Submitted by juancito, also found by luxartvinsec, leopoldjoy, popular00, pipoca, Chom, reassor, igingu, adriro, J4de, and Ruhum
Trays and their tiles are the building blocks for fusing a Namespace NFT. The tiles in a tray are generated based on a hash of the previous mint.
Users will need specific tiles to be able to create the name they want, so it is of utter importance for them to get the trays they want with their corresponding tiles. The users should be able to precompute this, as the documentation states:
The 7 tiles per tray are then generated according to a deterministic algorithm. A user can therefore precompute which trays he will get.
Users can pay the corresponding $NOTE tokens to buy a tray with some specific tiles, buy end up obtaining a completely different one with tiles they dont expect.
This can happen due to normal usage of the platform, with some user sending a transaction with more gas. Or by a malicious user frontrunning the transaction.
On any case the user ends up with an NFT he didnt want instead of reverting the transaction, and saving their $NOTE tokens.
There is no check on the buy() function to make sure that the user will actually buy the tray he wanted, thus possibly obtaining another one.
The tiles are calculated based on a hash. That hash is generated each time a new mint is produced, and it is based on the last one.
If the transaction is frontrunned, the user will get a new hash, and thus new tiles data for his tray.
Link to code
Check the hash for the last minted Tray NFT, to make sure it is the same the user used to precalculate the next tiles.
On the case the transaction is frontrunned, the expected hash will be different and the transaction will revert, saving the user from spending the $NOTE tokens.
OpenCoreCH (Canto Identity) acknowledged
0xleastwood (judge) commented:
