First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No calculation for increasing the total supply in HorseStore.huff::MINT_HORSE() prevents the minting of new NFTs

Turetos

Summary

The HorseStore.huff::MINT_HORSE() macro lacks the necessary calculations to increase the total supply each time a new NFT is minted,
resulting in the protocol being unable to mint new NFTs.
Additionally, there is a bug where the total supply value is not pushed onto the stack for the tokenId; instead, the address of the slot
is used

Vulnerability Details

The vulnerability is within the MINT_HORSE macro, with additional details provided in the following lines of code.

#define macro MINT_HORSE() = takes (0) returns (0) {
@> [TOTAL_SUPPLY] // [TOTAL_SUPPLY] Using the address of the TOTAL_SUPPLY SLOT instead of the value
caller // [msg.sender, TOTAL_SUPPLY]
_MINT() // []
@> Missing the calculation to increase the total supply by +1
stop // []
}
​

Impact

Absence of the correct calculation for the total supply value used in generating the tokenId renders the protocol incapable of minting
new NFTs. Employing the address of the TOTAL_SUPPLY slot rather than its value triggers the ALREADY_MINTED validation each time a new
NFT is attempted to be minted after the first one.

Tools Used

Stateful fuzzing with Foundry and manual review

Recommendations

Consider incorporating sload to load the value of TOTAL_SUPPLY onto the stack. Additionally, introduce the INCREASE_SUPPLY macro to
increment the value of TOTAL_SUPPLY by +1.

#define macro MINT_HORSE() = takes (0) returns (0) {
[TOTAL_SUPPLY] // [TOTAL_SUPPLY]
+ sload // [totalSupply]
caller // [msg.sender, TOTAL_SUPPLY]
_MINT() // []
+ INCREASE_SUPPLY()
stop // []
}

The macro used to increase the value of TOTAL_SUPPLY by +1.

#define macro INCREASE_SUPPLY() = takes (0) returns (0) {
[TOTAL_SUPPLY] // [TOTAL_SUPPLY]
sload // [totalSupply]
​
0x01 add // [totalSupply + 1]
[TOTAL_SUPPLY] // [TOTAL_SUPPLY, totalSupply + 1]
sstore // []
​
0x00 0x00 return //nothing to return
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Failure to increment total supply on mint

Failure to properly load the totalSupply in Huff

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.