KupiaSec - The founder allocation should be updated after changing reservedUntilTokenId.

[sherlock-admin2]

KupiaSec

medium

The founder allocation should be updated after changing reservedUntilTokenId.

Summary

After changing reservedUntilTokenId using Token.setReservedUntilTokenId(), the founder allocation mechanism wouldn't work as expected.

Vulnerability Detail

The owner can update reservedUntilTokenId using setReservedUntilTokenId() before starting the auction.

    function setReservedUntilTokenId(uint256 newReservedUntilTokenId) external onlyOwner {
        // Cannot change the reserve after any non reserved tokens have been minted
        // Added to prevent making any tokens inaccessible
        if (settings.mintCount > 0) {
            revert CANNOT_CHANGE_RESERVE();
        }

        // Cannot decrease the reserve if any tokens have been minted
        // Added to prevent collisions with tokens being auctioned / vested
        if (settings.totalSupply > 0 && reservedUntilTokenId > newReservedUntilTokenId) {
            revert CANNOT_DECREASE_RESERVE();
        }

        // Set the new reserve
        reservedUntilTokenId = newReservedUntilTokenId; //@audit should update founder allocations

        emit ReservedUntilTokenIDUpdated(newReservedUntilTokenId);
    }

As reservedUntilTokenId is used while adding founders, the founder allocation wouldn't work as expected.

1. During the initialization, there was one founder with ownershipPct = 1, reservedUntilTokenId = 0.
2. After calling _addFounders(), tokenRecipient[0] will be booked for the founder.
3. Before starting an auction, setReservedUntilTokenId() is called and reservedUntilTokenId = 1 now.
4. While minting NFTs with an auction, tokenId will start from reservedUntilTokenId = 1.
5. So the founder wouldn't receive any NFTs while minting 1 to 99 although he should've got one right after the auction starts.

Impact

The founder allocation mechanism would be broken after changing reservedUntilTokenId.

Code Snippet

https://github.com/sherlock-audit/2023-09-nounsbuilder/tree/main/nouns-protocol/src/token/Token.sol#L486

Tool used

Manual Review

Recommendation

We should update the founder allocations again after changing reservedUntilTokenId in setReservedUntilTokenId().