MinterContract.mint division by zero

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L249
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/MinterContract.sol#L292

Vulnerability details

Impact

The users would not be able to mint tokens if it implies a periodic sales model with the time period set to zero or not set. Also, the admins would be unable to mint and auction for the same reason.

Proof of Concept

Let's suppose the following scenario takes place:

1. Collection admin sets collection sales option to 3 and timePeriod to 0 by calling setCollectionCosts.
2. Alice tries to mint the token by calling the mint function; however, it will always revert with with panic code 0x12 (Division or modulo division by zero), which does not provide any context and users/admins without technical background would not be able to recognise the source of issue.

The reason is hidden in the evaluation if a period has passed to allow minting. Instances:

249:    uint tDiff = (block.timestamp - timeOfLastMint) / collectionPhases[col].timePeriod;

292:    uint tDiff = (block.timestamp - timeOfLastMint) / collectionPhases[_collectionID].timePeriod;

249, 292

Tools Used

Manual Review

Recommended Mitigation Steps

In setCollectionCosts, add a check for the _timePeriod parameter to be above zero if _salesOption equals 3. For instance:

if (_salesOption == 3) {
    require(_timePeriod > 0, "Time Period Not Set");
}

Assessed type

Error

[c4-pre-sort]

141345 marked the issue as duplicate of #1278

[c4-pre-sort]

141345 marked the issue as duplicate of #962

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #1278

[c4-judge]

alex-ppg marked the issue as duplicate of #1980

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Overinflated severity