When the contract gets the free NFT and there are no contributors, other users can contribute immediately and get full control of that NFT

[code423n4]

Lines of code

https://github.com/PartyDAO/party-contracts-c4/blob/3896577b8f0fa16cba129dc2867aba786b730c1b/contracts/crowdfund/AuctionCrowdfund.sol#L233-L242

Vulnerability details

Impact

In the finalize function of the AuctionCrowdfund contract, if the contract gets the free NFT and there are no contributors, the comment says " Nobody ever contributed. The NFT is effectively burned."
But in reality, the current status is Active because the transaction was reverted. Other users can immediately call the contribute and finalize functions to get full control of the NFT.

        if (nftContract.safeOwnerOf(nftTokenId) == address(this)) {
            if (lastBid_ == 0) {
                // The NFT was gifted to us. Everyone who contributed wins.
                lastBid_ = totalContributions;
                if (lastBid_ == 0) {
                    // Nobody ever contributed. The NFT is effectively burned.
                    revert NoContributionsError();
                }

This can also happen in BuyCrowdfundBase.

            settledPrice_ = callValue == 0 ? totalContributions : callValue;
            if (settledPrice_ == 0) {
                // Still zero, which means no contributions.
                revert NoContributionsError();
            }

Proof of Concept

https://github.com/PartyDAO/party-contracts-c4/blob/3896577b8f0fa16cba129dc2867aba786b730c1b/contracts/crowdfund/AuctionCrowdfund.sol#L233-L242
https://github.com/PartyDAO/party-contracts-c4/blob/3896577b8f0fa16cba129dc2867aba786b730c1b/contracts/crowdfund/BuyCrowdfundBase.sol#L122-L126

Tools Used

None

Recommended Mitigation Steps

If the contract expects the NFT to be frozen in this case, it should set the state to Finalized instead of revert the transaction.

[merklejerk]

It's true that the comment is misleading, as the NFT is technically not burned. However, we don't think it's necessarily harms the protocol for someone to claim a gifted NFT, especially because we consider this case to be extremely exceptional.

[HardlyDifficult]

Misleading comment - merging with the warden's QA report #142