Skip to content

Canvas can have unlimited supply even in case of dutch auction#

Medium Risk

In Create.sol there are createCanvas and updateCanvas functions through which canvas can be created/updated. In both cases, someone can set a canvas to have totalQuantity = 0 (which is considered unlimited) and be a dutch auction. Which means that the number of minted tokens will never equal the totalQuantity and therefore the line 539 in Minting.sol will never be executed. This means that canvasSystem[canvasId].dutchEndPrice will not be saved, and the seller will not be able to withdraw the funds if it is a refundable dutch. It also does not make sense to have a dutch auction that has unlimited supply. Since all the buyers can wait for the price to reach the end price without the risk of not getting a mint, which is the point of a dutch auction.

535
536
537
538
539
540
if (ds.canvas[canvasId].totalQuantity > 0 &&
    tokenIdCounter.add(quantity) > ds.canvas[canvasId].totalQuantity)
revert SoldOut();
else if (tokenIdCounter.add(quantity) == ds.canvas[canvasId].totalQuantity) {
    ds.canvasSystem[canvasId].dutchEndPrice = price;
}

Recommendation#

Add a check that prevents totalQuantity to be 0 in case of a dutch auction. For example: if(canvas.totalQuantity == 0 && canvas.dutchEndTime != 0) revert.