Submitted by kenzo
More keys can be minted than maxNumberOfKeys since shareKey and grantKey do not check if the lock is sold out.
More keys can be minted than intended.
In both shareKey and grantKey, if minting a new token, a new token is simply minted (and _totalSupply increased) without checking it against maxNumberOfKeys.
This is unlike purchase, which has the notSoldOut modifier.
grantKey:
https://github.com/code-423n4/2021-11-unlock/blob/main/smart-contracts/contracts/mixins/MixinGrantKeys.sol#L41:#L42
shareKey:
https://github.com/code-423n4/2021-11-unlock/blob/main/smart-contracts/contracts/mixins/MixinTransfer.sol#L83:#L84
Both functions call _assignNewTokenId which does not check maxNumberOfKeys.
https://github.com/code-423n4/2021-11-unlock/blob/main/smart-contracts/contracts/mixins/MixinKeys.sol#L311:#L322
So you can say that _assignNewTokenId is actually the root of the error, and this is why I am submitting this as 1 finding and not 2 (for grantKey/shareKey).
Add a check to _assignNewTokenId that will revert if we need to record a new key and maxNumberOfKeys has been reached.
julien51 (Unlock Protocol) confirmed and commented:
