Summary

Minting of new tokens from SmartVaultManagerV5 contract can be blocked.

Vulnerability Details

When a user mints a new token from the SmartVaultManagerV5 contract, the _safeMint function is called with the _afterTokenTransfer function. In this function, from = address(0), _to = msg.sender, and _tokenId = lastToken + 1;. Subsequently, the transferTokenId function of the smartVaultIndex contract is called.

smartVaultIndex.transferTokenId(_from, _to, _tokenId);

In the smartVaultIndex contract, during the minting process in the transferTokenId function, all tokenIds belonging to address(0) will be looped through.

Here is a code snippet from the deployed smartVaultIndex contract:

The looping of tokenIds will be skipped at the beginning because address(0) will not have any tokens belonging to it.

If a user decides to burn their token, the _afterTokenTransfer function will be called with _from = msg.sender and _to = address(0), leading to the tokenId being transferred to address(0).

If many token IDs are burned,at some time it may lead to a DDoS on minting new tokens, as gas will be consumed during the looping of tokenIds for address(0) in the smartVaultIndex contract.

Impact

Minting of new tokens from SmartVaultManagerV5 contract will be blocked.

Tools Used

Manual Review

Recommendations

When a token is burned, transfer it to address(1).