First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

User can mint infinite number of NFTs

sobieski

Summary

As the documentation states:

An address is only allowed to collect 1 NFT per address, there is a check in the codebase to prevent someone from minting duplicate NFTs.

The aforementioned check can be very easily bypassed, allowing the address to mint the infinite number of NFT.

Vulnerability Details

The check used to prevent the address from minting more than 1 NFT is the following:

if (balanceOf(msg.sender) > 0) {
revert SantasList__AlreadyCollected();
}

The attacker can very easily bypass this check and mint potentially infinite number of NFTs. As the balanceOf() method is used to determine the number of minted NFTs, the attacker can execute the following procedure:

  1. Mint an NFT using a SantansList::collectPresent() method

  2. Transfer the NFT to a second address he owns

  3. Repeat

Impact

A verified address can mint multiple NFTs instead of intented one

Tools Used

Manual review

Recommendations

Introduce the new mapping to like this to SantasList contract:

mapping(address person => bool presentClaimed) private s_addressHasAlreadyClaimedPresent;

Use this mapping in the collectPresent() method:

- if (balanceOf(msg.sender) > 0) {
+ if(s_addressHasAlreadyClaimedPresent[msg.sender])
revert SantasList__AlreadyCollected();
}

Finally, update the mapping every time the user claims the present:

function _mintAndIncrement() private {
+ s_addressHasAlreadyClaimedPresent[msg.sender] = true;
_safeMint(msg.sender, s_tokenCounter++);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak Already Collected Check

Relying on balanceOf > 0 in collectPresent() allows the msg.sender to send their present to another address and then collect again.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.