Incorrect Calculation of Mint Price When Mint Count Equals Max Tokens Per Generation

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-07-traitforge/blob/279b2887e3d38bc219a05d332cbcb0655b2dc644/contracts/TraitForgeNft/TraitForgeNft.sol#L227-L232
https://github.com/code-423n4/2024-07-traitforge/blob/279b2887e3d38bc219a05d332cbcb0655b2dc644/contracts/TraitForgeNft/TraitForgeNft.sol#L280-L309

Vulnerability details

Impact

The _mintInternal function does not correctly handle the case when the number of minted tokens in the current generation equals maxTokensPerGen. This can lead to incorrect mint price calculations when the generation is incremented.
As a result, users might encounter errors such as 'Insufficient ETH send for minting.' due to mismatches between the expected and actual mint price.

Proof of Concept

In the provided test code, the issue manifests as follows:

describe('test', () => {
  it('test calculating mint price', async () => {
    const maxTokensPerGen = await nft.maxTokensPerGen();
    const startPrice = await nft.startPrice();
    for(let i = 0; i < maxTokensPerGen; i++) {
      await nft.connect(owner).mintToken(merkleInfo.whitelist[0].proof, {
        value: ethers.parseEther('1'),
      });
    }

    console.log(await nft.calculateMintPrice());
    await expect(
      nft.connect(user1).mintToken(merkleInfo.whitelist[1].proof, {
        value: startPrice
      })
    ).to.be.revertedWith('Insufficient ETH send for minting.');
  });
});

This test reveals that after minting the maximum number of tokens, the next mint attempt fails due to incorrect price calculation.

Tools Used

Manual code review

Recommended Mitigation Steps

This is the mitigated code.

function _mintInternal(address to, uint256 mintPrice) internal {    // @audit-ok
  _tokenIds++;
  uint256 newItemId = _tokenIds;
  _mint(to, newItemId);
  uint256 entropyValue = entropyGenerator.getNextEntropy();

  tokenCreationTimestamps[newItemId] = block.timestamp;
  tokenEntropy[newItemId] = entropyValue;
  tokenGenerations[newItemId] = currentGeneration;
  generationMintCounts[currentGeneration]++;
  initialOwners[newItemId] = to;

  if (generationMintCounts[currentGeneration] >= maxTokensPerGen) {
    _incrementGeneration();
  }

  if (!airdropContract.airdropStarted()) {
    airdropContract.addUserAmount(to, entropyValue);
  }

  emit Minted(
    msg.sender,
    newItemId,
    currentGeneration,
    entropyValue,
    mintPrice
  );

  _distributeFunds(mintPrice);
}

Assessed type

Invalid Validation

[c4-judge]

koolexcrypto marked the issue as duplicate of #564