Submission Details
Severity:
collectPresent can be called several times
Summary
Function collectPresent supposed to mint only one present to a person but can be called several times if NFT is transferred
Vulnerability Details
To make sure present is not minted twice, balanceOf(msg.sender) > 0 is used. However balance can be 0 if user collected NFT and transferred it to another account
Impact
Person can unlimitedly mint gifts
Tools Used
Recommendations
Store information about given NFTS in mapping. Consider to prohibit NFT transferring
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Weak Already Collected Check
Relying on balanceOf > 0 in collectPresent() allows the msg.sender to send their present to another address and then collect again.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.