circlelooper - tokenRecipient mapping maps invalid baseTokenId to founder info

[sherlock-admin]

circlelooper

high

tokenRecipient mapping maps invalid baseTokenId to founder info

Summary

tokenRecipient mapping maps invalid baseTokenId to founder info.

Vulnerability Detail

tokenRecipient mapping maps baseTokenId to founder info.

When Token contract is initialized, founder info is added to tokenRecipient by calling _addFounders().

baseTokenId is set as key to founder info, and it is returned by _getNextTokenId():

    function _getNextTokenId(uint256 _tokenId) internal view returns (uint256) {
        unchecked {
            while (tokenRecipient[_tokenId].wallet != address(0)) {
                _tokenId = (++_tokenId) % 100;
            }


            return _tokenId;
        }
    }

Initially, baseTokenId is the same as reservedUntilTokenId, if its founder info is not set, then the same value will be used as key to map founder info:

                    tokenRecipient[baseTokenId] = newFounder;

When mints a token, baseTokenId is calculated as below:

        uint256 baseTokenId = _tokenId % 100;

If tokenRecipient[baseTokenId].wallet points to founder's wallet, then the token will be set to the founder.

            _mint(tokenRecipient[baseTokenId].wallet, _tokenId);

Consider the following scenario:

1. reservedUntilTokenId is 100, then baseTokenId is 100
2. tokenRecipient[_tokenId].wallet is address(0), then tokenRecipient[100] is set to founder info
3. When mints a token, because baseTokenId = _tokenId % 100, it will never be 100, so tokenRecipient[100] can never be matched, the founder info is thus never be get, no token will be sent to founder.

Impact

No token will be sent to founder.

Code Snippet

https://github.com/sherlock-audit/2023-09-nounsbuilder/blob/main/nouns-protocol/src/token/Token.sol#L265

Tool used

Manual Review

Recommendation

Please consider to set baseTokenId to be less than 100 while calculating:

    function _getNextTokenId(uint256 _tokenId) internal view returns (uint256) {
        unchecked {
            while (tokenRecipient[_tokenId].wallet != address(0)) {
                _tokenId = (++_tokenId) % 100;
            }

+           if (_tokenId >= 100) {
+               _tokenId = _tokenId % 100;
+           }
            return _tokenId;
        }
    }

Duplicate of #42