Submission Details
Severity:
Unrestricted Token Minting via buyPresent Function
Vulnerability Details
The buyPresent function currently allows any user to mint tokens for themselves without any restrictions. This is due to the lack of access control and the direct call to _mintAndIncrement() within the function.
function buyPresent(address presentReceiver) external { //@audit no access control
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
function _mintAndIncrement() private {
_safeMint(msg.sender, s_tokenCounter++);
}
Impact
This flaw could lead to significant issues in the token economy, such as token inflation or devaluation, as it permits unrestricted minting of new tokens by any user.
Recommendations
Restrict Access for Minting: Implement stringent access controls to prevent unauthorized token minting.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.