First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

HorseStore.huff::_MINT() does not update TOTAL_SUPPLY

0xpoor4ever

Summary

The _MINT() does not update TOTAL_SUPPLY storage, leading to a revert if mintHorse() is called more than once, as subsequent calls with the same token_id 0 result in duplicate minting

Vulnerability Details

Add this test to Base_Test.t.sol and run forge test --mt testMultipleMint -vvvv to validate the issue

function testMultipleMint() public {
vm.startPrank(user);
for (uint256 index; index < 100; ++index) {
horseStore.mintHorse();
}
vm.stopPrank();
assertEq(100, horseStore.totalSupply());
}

A revert occurs when the mintHorse() function is called for the second time, output:

[62292] HorseStoreHuff::testMultipleMint()
├─ [0] VM::startPrank(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D])
│ └─ ← ()
├─ [50931] 0x6d2eed85750d316088343D6d5e91ca59eb052768::mintHorse()
│ ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], tokenId: 0)
│ └─ ← ()
├─ [501] 0x6d2eed85750d316088343D6d5e91ca59eb052768::mintHorse()
│ └─ ← revert: ALREADY_MINTED
└─ ← revert: ALREADY_MINTED

Impact

The mintHorse() function is not functioning properly, and users can only successfully call it once.

Tools Used

manual inspection

Recommendations

Update TOTAL_SUPPLY in the _MINT(), Add the following line of code in the _MINT() in HorseStore.huf

// Give tokens to the recipient.
TRANSFER_GIVE_TO() // [from (0x00), to, tokenId]
​
+ [TOTAL_SUPPLY] sload 0x01 add [TOTAL_SUPPLY] sstore
​
// Emit the transfer event.
__EVENT_HASH(Transfer) // [sig, from (0x00), to, tokenId]
0x00 0x00 log4 // []
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Failure to increment total supply on mint

Failure to properly load the totalSupply in Huff

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!