saian - Token.sol : Function updateFounders does not clear the correct base id

[sherlock-admin2]

saian

medium

Token.sol : Function updateFounders does not clear the correct base id

Summary

Difference in first base id in function _addFounders and updateFounders will result in function updateFounders not clearing the correct base id

Vulnerability Detail

baseTokenId calculation is different in the functions as baseTokenId starts from reserveUntilTokenId in _addFounders and 0 in updateFounders. So old founders will not be removed from tokenRecipient mapping and will receive tokens if the vesting period is not over

Impact

Old founders will not be removed from the tokenRecipient mapping and will recieve tokens if the vesting period is not completed

Code Snippet

https://github.com/sherlock-audit/2023-09-nounsbuilder/blob/main/nouns-protocol/src/token/Token.sol#L375

        uint256 baseTokenId;

        for (uint256 j; j < cachedFounder.ownershipPct; ++j) {
            // Get the next index that hasn't already been cleared
            while (clearedTokenIds[baseTokenId] != false) {
                baseTokenId = (++baseTokenId) % 100;
            }

            delete tokenRecipient[baseTokenId];
            clearedTokenIds[baseTokenId] = true;

            emit MintUnscheduled(baseTokenId, i, cachedFounder);

            // Update the base token id
            baseTokenId = (baseTokenId + schedule) % 100;
        }
    }

Tool used

Manual Review

Recommendation

Change the first base token id in _addFounders to

    uint256 baseTokenId = 0;

Duplicate of #42