Merge pull request #1 from 0xalpharush/master

contracts/BatchAuction.sol

@@ -99,12 +99,15 @@ contract BatchAuction is BatchRevealBase {
         for(uint256 i = 0; i < winningBidIds.length; i++) {
             uint256 curBidId = winningBidIds[i];
             Bid storage curBid = bidPriorityQueue.bidIdToBidMap[curBidId];
-            for(uint256 j = 0; j < curBid.quantity; j++) {
-                _safeMint(msg.sender, ++nftCount);
-            }
+            //cache quantity in memory for price calc and minting
+            uint256 qty = curBid.quantity;
             //charge user quantity times clearing price
-            balance -= curBid.quantity * clearingPrice;
+            //update balance and quantity before minting to prevent reentrant claims
+            balance -= qty * clearingPrice;
             curBid.quantity = 0;
+            for(uint256 j = 0; j < qty; j++) {
+                _safeMint(msg.sender, ++nftCount);
+            }
         }
         //refund any contributions not spent on mint
         (bool sent, ) = payable(msg.sender).call{value: balance}("");
@@ -154,4 +157,4 @@ contract BatchAuction is BatchRevealBase {
     function getBidById(uint256 id) public view returns (Bid memory) {
         return bidPriorityQueue.bidIdToBidMap[id];
     }
-}
+}