timelockMint In TimelockRewardDistributionTokenImpl Does Not Ensure Mint Is Greater Than Zero

[code423n4]

Handle

leastwood

Vulnerability details

Impact

The timelockMint function attempts to mint a token amount via some timelock period. However, minting an amount = 0 will cause the caller's tokens to be timelocked again.

Proof of Concept

https://github.com/code-423n4/2021-12-nftx/blob/main/nftx-protocol-v2/contracts/solidity/token/TimelockRewardDistributionTokenImpl.sol#L100-L105

function timelockMint(address account, uint256 amount, uint256 timelockLength) public onlyOwner virtual {
  uint256 timelockFinish = block.timestamp + timelockLength;
  timelock[account] = timelockFinish;
  emit Timelocked(account, amount, timelockFinish);
  _mint(account, amount);
}

Tools Used

Manual code review.

Recommended Mitigation Steps

Consider disallowing amount = 0 from being used in timelockMint. The following require statement can be used to enforce this behaviour.

require(amount > 0, "Cannot mint zero amount");

[0xKiwi]

Fair find. Confirming.