Submission Details
Severity:
Huff version does not require the correct implementation of onERC721received in the mint function
Summary
Huff version does not require the correct implementation of onERC721received in the mint function, allowing contracts to freely mint horses as well.
Vulnerability Details
Mint function works differently for contracts between the huff and solidity versions as onERC721received
Paste the below into Base_Test.t.sol
function testMintingPOC() public {
uint256 horseId = horseStore.totalSupply();
vm.warp(10);
vm.roll(10);
vm.prank(user);
horseStore.mintHorse();
horseStore.mintHorse();
}
Impact
Not much as anyone can freely mint more horses anyway.
Tools Used
Foundry
Recommendations
Implement the onERC721received correctly in the huff version
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Components of ERC721 not properly (or at all) implemented in HUFF
Rewards breakdown
nSLOC
460This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.