First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No calculation for increasing the total supply in HorseStore.huff::MINT_HORSE() prevents the minting of new NFTs

Turetos

Summary

The HorseStore.huff::MINT_HORSE() macro lacks the necessary calculations to increase the total supply each time a new NFT is minted,
resulting in the protocol being unable to mint new NFTs.
Additionally, there is a bug where the total supply value is not pushed onto the stack for the tokenId; instead, the address of the slot
is used

Vulnerability Details

The vulnerability is within the MINT_HORSE macro, with additional details provided in the following lines of code.

#define macro MINT_HORSE() = takes (0) returns (0) {
@> [TOTAL_SUPPLY] // [TOTAL_SUPPLY] Using the address of the TOTAL_SUPPLY SLOT instead of the value
caller // [msg.sender, TOTAL_SUPPLY]
_MINT() // []
@> Missing the calculation to increase the total supply by +1
stop // []
}
​

Impact

Absence of the correct calculation for the total supply value used in generating the tokenId renders the protocol incapable of minting
new NFTs. Employing the address of the TOTAL_SUPPLY slot rather than its value triggers the ALREADY_MINTED validation each time a new
NFT is attempted to be minted after the first one.

Tools Used

Stateful fuzzing with Foundry and manual review

Recommendations

Consider incorporating sload to load the value of TOTAL_SUPPLY onto the stack. Additionally, introduce the INCREASE_SUPPLY macro to
increment the value of TOTAL_SUPPLY by +1.

#define macro MINT_HORSE() = takes (0) returns (0) {
[TOTAL_SUPPLY] // [TOTAL_SUPPLY]
+ sload // [totalSupply]
caller // [msg.sender, TOTAL_SUPPLY]
_MINT() // []
+ INCREASE_SUPPLY()
stop // []
}

The macro used to increase the value of TOTAL_SUPPLY by +1.

#define macro INCREASE_SUPPLY() = takes (0) returns (0) {
[TOTAL_SUPPLY] // [TOTAL_SUPPLY]
sload // [totalSupply]
​
0x01 add // [totalSupply + 1]
[TOTAL_SUPPLY] // [TOTAL_SUPPLY, totalSupply + 1]
sstore // []
​
0x00 0x00 return //nothing to return
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Failure to increment total supply on mint

Failure to properly load the totalSupply in Huff

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!