Attacker can use burnToMint() to mint tokens without burning

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L258
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/NextGenCore.sol#L218

Vulnerability details

Impact

• The following attack flow is possible:

An attacker calls MinterContract.burnToMint() -> safeMint() calls IERC721Receiver(to).onERC721Received -> the to contract calls MinterContract.burnToMint().

• _safeMint() is called before _burn() implying that the attacker can keep minting tokens without burning:

_mintProcessing(mintIndex, ownerOf(_tokenId), tokenData[_tokenId], _mintCollectionID, _saltfun_o);
// burn token
_burn(_tokenId);
burnAmount[_burnCollectionID] = burnAmount[_burnCollectionID] + 1;

TODO Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Manual inspection.

Recommended Mitigation Steps

• Call _burn() before _mintProcessing().
• Add a reentrancy guard to NextGenCore.burnToMint()

Assessed type

Reentrancy

[c4-pre-sort]

141345 marked the issue as duplicate of #51

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #1597

[c4-pre-sort]

141345 marked the issue as duplicate of #1742

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #90

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid