Users can recover already burned gobblers after minting a legendary gobbler.

Lines of code Vulnerability details Impact Users can recover already burned gobblers after minting a legendary gobbler. The main flaw is that it doesn't reset getApprovedid here. As a result, users can have more emissionMultiple than they should by recovering the burned gobblers. Proof of Concept...

Forgetting to delete approval can help attacker mint any legendary gobbler with 0 cost of standard gobblers

Lines of code Vulnerability details 2022-09-artgobblers Forgetting to delete approval can help attacker mint any legendary gobbler with 0 cost of standard gobblers. tags: c4, 2022-09-artgobblers, high Affected code Impact When mint new lengendary gobbler, an amount of standard gobblers cost must ...

The users can steal the Gobbler from the team

Lines of code Vulnerability details Impact In case mintReservedGobblers start minting let's say 20 for team + 20 for community And the loop on batchMint is now i == 3 Now Alice will invoke mintFromGoo to mint one Gobbler he will steal this Gobbler from the team address Proof of Concept Let’s say...

A malicious user can claim and successfuly steal a gobbler NFT token.

Lines of code Vulnerability details Impact A malicious user can claim and successfuly steal a gobbler NFT token in the function claimGobbler. Proof of Concept The function claimGobbler is used from the mintlisted users to claim a gobbler using a merkle proof. However there is no check to ensure...

User Might End Up Losing Preferred Gobblers to mint Legendary Gobbler

Lines of code Vulnerability details Impact mintLegendaryGobbler function of ArtGobblers.sol contract doesn't check whether user input parameter of gobblerIds is equal or more than the cost of legendary gobbler. It only check whether it is less than or not. Therefore it is possible for user to inp...

Dutch auction on-chain might work as expected

Lines of code Vulnerability details Impact Dutch auction on-chain for Page and Gobbler might work as expected. Bidders could spontaneously form some group to take advantage of the rule. The protocol will receive much less fund from auctions, effectively the auction funds being stolen. Proof of...

Users can mint legendary gobbler without losing any gobblers

Lines of code Vulnerability details Impact In ArtGobblers.mintLegendaryGobbler function, it mints a legendary gobbler by burning multiple standard gobblers. But instead of call burn, it just set getGobblerDataid.owner = address0. All the data of the standard gobbler will stay the same, included...

after mintLegendaryGobbler(), the burned Gobbler can be transferred back

Lines of code Vulnerability details Impact mintLegendaryGobbler burn Gobbler only set the owner=address0, and did not clear getApprovedid, resulting in the transferFrom can be called to transfer back to old owner Proof of Concept Suppose users0 has Gobbler1 steps: step 1:users0 call...

Mint legendary gobbler for free

Lines of code Vulnerability details Impact Minting a legendary gobbler does not delete getApproved, thus an owner can approve himself before minting the legendary and later transfer back these ordinary gobblers. mintLegendaryGobbler performs an imitation of burning by setting an owner to address0...