ArtGobblers contract wouldn't receive a random seed forever by a malicious user.

Lines of code Vulnerability details Impact ArtGobblers contract wouldn't receive a random seed forever by a malicious user. Currently it can't execute revealGobblers and upgradeRandProvider when gobblerRevealsData.waitingForSeed == true. So if the contract fails to receive the random seed after...

ArtGobblers.sol#L411 : mintLegendaryGobbler can be executed without gobblerIds also

Lines of code Vulnerability details Impact The function mintLegendaryGobbler can be called without any gobblerIds as well. Proof of Concept. to mint the legendary gobbler in the function mintLegendaryGobbler, the line ArtGobblers.solL418 calculates the cost. uint256 cost = legendaryGobblerPrice;...

Community/Team owner can steal gobbler by sending it to arbitrary address

Lines of code Vulnerability details Impact A malicious owner can steal all of its reserved gobbler. This is possible because owner can send reserved gobbler by withdraw function to ANY ARBITRARY ADDRESS. Proof of Concept owner can set any address to to parameter of withdraw function of...

ArtGobblers.sol#L396-L402 : The function "gobblerPrice()" does not check whether the mint has started or not

Lines of code Vulnerability details Impact This could revert due to undeflow. Proof of Concept While calculating the gobblerPrice, the function does not check whether the mintStart time is started or not. If it is future time, calling this could revert. This could affect the mintFromGoo function ...

Re-entrancy risk to Project in ArtGobblers.gobble()

Lines of code Vulnerability details Impact In ArtGobblers.gobble, the function accepts user controlled input which may create re-entrancy opportunity in the ERC1155.safeTransferFrom and ERC721.transferFrom external calls . Since the nft parameter is user-controlled, any user can create a maliciou...

Users can mint legendary gobbler without losing any gobblers

Lines of code Vulnerability details Impact In ArtGobblers.mintLegendaryGobbler function, it mints a legendary gobbler by burning multiple standard gobblers. But instead of call burn, it just set getGobblerDataid.owner = address0. All the data of the standard gobbler will stay the same, included...

Mint legendary gobbler for free

Lines of code Vulnerability details Impact Minting a legendary gobbler does not delete getApproved, thus an owner can approve himself before minting the legendary and later transfer back these ordinary gobblers. mintLegendaryGobbler performs an imitation of burning by setting an owner to address0...