Token hash will never be set incase of a failed randomness callback

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/NextGenCore.sol#L299

Vulnerability details

Impact

In any case if the chainlink or ArrngConsumer fails to callback the fulfillRandomWords the token hash for that token will never be set.

Proof of Concept

When minting a new token the randomness request is also called in the process and that request is callback by the
randomizerContract for the particular collection if the collection's randomizerContract is chainlink or arrng and if they ever fail to callback the setTokenHash function will never be called for the minted token and the token hash will never be set for that token.

Tools Used

manual

Recommended Mitigation Steps

add a function to manually add a token hash if it is not set in a given time. Or split the request randomness and the minting of token and give another function where only the token owner can call to ask for randomness if the first one failed.

Assessed type

Oracle

[c4-pre-sort]

141345 marked the issue as duplicate of #1464

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid