Submission Details
Severity:
Minting does not increment totalSupply, so only one horse can be minted
Summary
The _MINT() Huff macro is not incrementing TOTAL_SUPPLY after transferring the new NFT, so it will always remain zero.
Vulnerability Details
The _MINT() macro should increment TOTAL_SUPPLY after the transfer.
#define macro _MINT() = takes (2) returns (0) {
...
// Emit the transfer event.
__EVENT_HASH(Transfer) // [sig, from (0x00), to, tokenId]
0x00 0x00 log4 // []
@>
// Continue Executing
cont jump
...
}
Impact
Only one horse can be minted, subsequent mints will revert.
Tools Used
Foundry, Manual review
Proof of Concept
This is a test that mints two horses, and expects a revert in the second mint.
function testMultipleMintFailsHuff() public {
vm.startPrank(user);
horseStore.mintHorse();
vm.expectRevert();
horseStore.mintHorse();
}
Run Huff test
forge test --mc HorseStoreHuff --mt testFeedingMakesHappyHorse
The test will pass, confirming that the second mint reverts.
Running 1 test for test/HorseStoreHuff.t.sol:HorseStoreHuff
[PASS] testMultipleMintFailsHuff() (gas: 60297)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.40s
Recommended Mitigation
Increment TOTAL_SUPPLY after mint.
Modify _MINT() macro
// Emit the transfer event.
__EVENT_HASH(Transfer) // [sig, from (0x00), to, tokenId]
0x00 0x00 log4 // []
+
+ // Increment TOTAL_SUPPLY
+ [TOTAL_SUPPLY] // [TOTAL_SUPPLY, from (0x00), to, tokenId]
+ sload // [totalSupply, from (0x00), to, tokenId]
+ 0x01 add // [totalSupply+1, from (0x00), to, tokenId]
+ [TOTAL_SUPPLY] // [TOTAL_SUPPLY, totalSupply+1, from (0x00), to, tokenId]
+ sstore // [from (0x00), to, tokenId]
+
// Continue Executing
cont jump
Updates
Lead Judging Commences
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
Failure to increment total supply on mint
Failure to properly load the totalSupply in Huff
Rewards breakdown
nSLOC
460This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.