Mint can be front-run

[code423n4]

Handle

cmichel

Vulnerability details

Vulnerability Details

The price of an MFT falls over time which creates a dynamic that one potential buyers want to wait for the price to drop but also not wait too long to avoid hitting the max sale cap.
However, on public blockchains any such mint call can be observed and attackers can simply wait until another person decides to buy at the current price and then frontrun that person.

Impact

Legitimate minters can be frontrun and end up with a failed transaction and without the NFT as the max sale limit is reached: require(numSales < SALE_LIMIT, "Sale limit reached.");

Recommended Mitigation Steps

Front-running is hard to prevent, maybe an auction-style minting process could work where the top SALE_LIMIT bids are accepted after the sale duration.