Submission Details
Severity:
SantasList _mintAndIncrement() will always be minted to msg.sender which shouldn't be allowed
Summary
_mintAndIncrement() will always mint an NFT to msg.sender, it will never mint the NFT to someone else if the msg.sender's purpose is to mint the NFT to someone else.
Vulnerability Details
msg.sender will never be able to mint the NFT to someone else.
Impact
breaks the rule that only one NFT can be minted to someone, malicious users can take advantage of this to mint as many NFTs they want for themselves.
Tools Used
Manual Review
Recommendations
- function _mintAndIncrement() private {
+ function _mintAndIncrement(address presentReceiver) private {
+ if (balanceOf(presentReceiver) > 0) {
+ revert SantasList__AlreadyCollected();
+ }
- _safeMint(msg.sender, s_tokenCounter++);
+ _safeMint(presentReceiver, s_tokenCounter++);
}
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.