Submission Details
Severity:
collectPresent() check the current balance of user
Summary
collectPresent() checks the current balance of the user, allowing users to mint multiple times.
Vulnerability Details
Nice people can mint multiple times using the following scenario:
Mint.
Transfer the NFT to another address.
Mint again.
Repeat.
Impact
This leads to the dilution of the value of the NFT as it permits an unlimited supply.
Tools Used
Manual review.
Recommendations
Keep accounting records in storage.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Weak Already Collected Check
Relying on balanceOf > 0 in collectPresent() allows the msg.sender to send their present to another address and then collect again.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.