First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Attacker can bypass NFT balance check to collect multiple presents

Ryan

Summary

User can bypass NFT balance check by transferring out minted NFT to other address, and minting again

Vulnerability Details

collectPresent function uses balanceOf(msg.sender) > 0 to prevent user from collecting multiple presents. This is not safe, because user can transfer minted NFT to other addresses, and then call collectPresent function to get another NFT.

POC

vm.startPrank(attacker);
santasList.collectPresent();
santasList.transferFrom(attacker, otherAddress, id);
santasList.collectPresent();
vm.stopPrank();
​

Impact

User with status nice or extra nice can collect multiple NFTs without limit.

Tools Used

Foundry

Recommendations

Using a mapping to store historical minting actions, can check that mapping instead of NFT balance of user before minting.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak Already Collected Check

Relying on balanceOf > 0 in collectPresent() allows the msg.sender to send their present to another address and then collect again.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.