Submitted by gzeon, also found by Trust and Lambda
When _purchaseProof.length == 0, GroupBuy.purchase compare the tokenId with the merkleRoot. This allows any tokenId that matches the merkleRoot to be purchased, even if they are not included in the allow list during setup.
https://github.com/code-423n4/2022-12-tessera/blob/f37a11407da2af844bbfe868e1422e3665a5f8e4/src/modules/GroupBuy.sol#L186-L188
Add the following to GroupBuy.t.sol. It would still revert (since no such nft existed) but not as expected.
Foundry
Hash the tokenId even if there is only when length is 1.
stevennevins (Tessera) disagreed with severity
HickupHH3 (judge) decreased severity to Medium and commented:
