Submission Details
Severity:
`SantasList::buyPresent` mints NFT to wrong address
Summary
SantasList::buyPresent mints NFT to wrong address
Vulnerability Details
SantasList::buyPresent is a function that allows any user to burn SantaTokens and mint NFT presents to a receiver address. After burning SANTA ERC20 tokens, it then calls the internal function _mintAndIncrement which mints the NFT present to the msg.sender, when it should be minted to the presentReceiver.
Impact
MEDIUM.
Tools Used
Manual Review
Recommendations
Instead of using the internal _mintAndIncrement function, use the safe mint directly
function buyPresent(address presentReceiver) external {
i_santaToken.burn(presentReceiver);
- _mintAndIncrement();
+ _safeMint(presentReceiver, s_tokenCounter++)
}
Updates
Lead Judging Commences
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
buyPresent should send to presentReceiver
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.