First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Reentrancy Attack in _mintAndIncrement function due to _safeMint

Ryan

Summary

_mintAndIncrement function uses _safeMint of ERC721 token, which leaves reentrancy attack vector.

Vulnerability Details

ERC721 token _safeMint invoke receiver's callback function, which can be used in a reentrancy attack. In this case, it can be used to mint multiple NFTs or SantaToken in collectPresent function.
For example a callback function can reenter collectPresent function to mint another NFT. (Attacker needs to transfer out minted NFT to bypass balance check)

POC

​
function onERC721Received(
address operator,
address from,
uint256 tokenId,
bytes calldata data
) external returns (bytes4) {
if (santasList.balanceOf(otherAddress) < 10) {
santasList.transferFrom(address(this), otherAddress, tokenId);
santasList.collectPresent();
}
​
return IERC721Receiver.onERC721Received.selector;
}
​

Impact

Attacker can mint muliple NFTs and SantaToken.

Tools Used

Foundry

Recommendations

(1) use _mint() function of ERC721, to avoid invoking callback
or (2) add reentrancy guard in collectPresent, buyPresent functions.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 3 years ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!