Submitted by AkshaySrivastav, also found by seyni, tnevler, wait, nalus, immeas, gzeon, lukris02, minhtrng, kiki_dev, adriro, Soosh, KingNFT, mahdikarimi, ladboy233, jonatascm, kree-dotcom, csanuragjain, _Adam, hihen, jadezti, reassor, gz627, 0xA5DF, 0xdeadbeef0x, nameruse, danyams, hansfriese, Madalad, gasperpre, yixxas, Parth, lumoswiz, obront, eyexploit, rvierdiiev, and 0x52
https://github.com/code-423n4/2022-12-escher/blob/main/src/minters/FixedPrice.sol#L73
https://github.com/code-423n4/2022-12-escher/blob/main/src/minters/LPDA.sol#L81-L88
In the buy function of FixedPrice and LPDA contracts, the transfer of funds to saleReceiver only happens when newId becomes equal to finalId, i.e, when the entire batch of NFTs gets sold completely.
FixedPrice:
LPDA:
This logic can cause issues if only a subset of NFTs get sold. In that case the ETH collected by contract from the sales of NFTs will get stuck inside the contract.
There is no function inside those contracts to recover the ETH collected from the partial sale of the NFT batch. There is also no function to send back those ETH to the NFT buyers. This causes the ETH to be in a stuck state as they cannot be pulled from the contracts.
The only way to recover those ETH is to explicitly buy the entire batch of to-be-sold NFTs so that the contract automatically triggers the sale ending conditions. This recovery method may require a decent amount of upfront capital to buy all unsold NFTs.
Consider this scenario:
The scenario for the LPDA sale contract is similar. ETH can get stuck for partial batch NFT sales and upfront capital will be needed to recover the ETH.
The contracts can have an additional function to claim the ETH collected from already successful NFT sales.
Please note, use of transfer is not recommended. The above code is just an example mitigation.
mehtaculous (Escher) disagreed with severity and commented:
berndartmueller (judge) decreased severity to Medium and commented:
