zraxx - The first founder's share will be lost by 1% when reservedUntilTokenId>=100

[sherlock-admin]

zraxx

medium

The first founder's share will be lost by 1% when reservedUntilTokenId>=100

Summary

The first founder's share will be lost by 1% when reservedUntilTokenId>=100.

Vulnerability Detail

When calculating the baseTokenId corresponding to the founder's share, since initially baseTokenId = reservedUntilTokenId and tokenRecipient[reservedUntilTokenId].wallet != address(0), the baseTokenId corresponding to the first 1% share of the first founder will be reservedUntilTokenId . Hence, when reservedUntilTokenId>=100, this 1% share will be lost. Subsequent shares will not be affected because the range of baseTokenId will correctly fall between 0-99.

uint256 baseTokenId = reservedUntilTokenId;

// For each token to vest:
for (uint256 j; j < founderPct; ++j) {
    // Get the available token id
    baseTokenId = _getNextTokenId(baseTokenId);

    // Store the founder as the recipient
    tokenRecipient[baseTokenId] = newFounder;

    emit MintScheduled(baseTokenId, founderId, newFounder);

    // Update the base token id
    baseTokenId = (baseTokenId + schedule) % 100;
}

Impact

Founder loses 1% share

Code Snippet

https://github.com/sherlock-audit/2023-09-nounsbuilder/blob/main/nouns-protocol/src/token/Token.sol#L161

https://github.com/sherlock-audit/2023-09-nounsbuilder/blob/main/nouns-protocol/src/token/Token.sol#L186

Tool used

Manual Review

Recommendation

Patch method 1:

modify function _addFounders

uint256 baseTokenId = reservedUntilTokenId % 100;  // <------ modify

// For each token to vest:
for (uint256 j; j < founderPct; ++j) {
    // Get the available token id
    baseTokenId = _getNextTokenId(baseTokenId);

    // Store the founder as the recipient
    tokenRecipient[baseTokenId] = newFounder;

    emit MintScheduled(baseTokenId, founderId, newFounder);

    // Update the base token id
    baseTokenId = (baseTokenId + schedule) % 100;
}

Patch method 2:

modify function _getNextTokenId

function _getNextTokenId(uint256 _tokenId) internal view returns (uint256) {
        unchecked {
	   _tokenId = _tokenId % 100;   // <------ add

            while (tokenRecipient[_tokenId].wallet != address(0)) {
                _tokenId = (++_tokenId) % 100;
            }

            return _tokenId;
        }
    }

Duplicate of #42