Submission Details
Severity:
Everyone can mint unlimited NFTs and burn tokens from users
Summary
buyPresent is wrongly implemented
Vulnerability Details
There is no check if the person calling has Santa Tokens, it will burn from the provided address instead of msg.sender
It will mint the NFT to the caller instead of the presentReceiver
Impact
Wrongly implemented function
Tools Used
Foundry/Manual Review
Recommendations
add a balance check if caller has Santa Tokens,
burn from msg.sender (buying the present for presentReceiver)
mint to the presentReceiver address
function buyPresent(address presentReceiver) external {
if (i_santaToken.balanceOf(msg.sender) < 1e18) {
revert("buyPresent__NotEnoughBalance()");
}
i_santaToken.burn(msg.sender);
// safeMint has built in Address(0) check
_safeMint(presentReceiver, s_tokenCounter++);
}
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
buyPresent should use msg.sender
Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.
buyPresent should send to presentReceiver
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.