Submission Details
Severity:
[H-1] No return value and no emitted event in the function `OneShot::mintRapper()`. The user can't know the id of the minted Rapper.
Summary
A user can't know the id of his minted Rapper NFT.
Vulnerability Details
There is no return value and no emitted event in the OneShot::mintRapper() function :
@>> function mintRapper() public {
// q No return ? The user can't know what is the id of his minted rapper
// @audit-high The user can't know the id of the minted NFT. There is no
// emitted event in the _safeMint function by openzeppelin
uint256 tokenId = _nextTokenId++;
_safeMint(msg.sender, tokenId);
// Initialize metadata for the minted token
rapperStats[tokenId] = RapperStats({
weakKnees: true,
heavyArms: true,
spaghettiSweater: true,
calmAndReady: false,
battlesWon: 0
});
@>>
}
Impact
When multiples users mint a the same time a Rapper NFT with the OneShot::mintRapper(), they can't know what the id of their NFT is.
The only way to know the NFT id before minting a Rapper is to use OneShot::getNextTokenId(). However, if users simultaneously mint a rapper, returned value by OneShot::getNextTokenId() can be different than the minted Rapper NFT.
Tools Used
Foundry
Recommendations
Emit an event and return a value inside OneShot::mintRapper() :
+ event MintedRaper(address indexed user, uint256 tokenId);
- function mintRapper() public {
+ function mintRapper() public returns (uint256) {
uint256 tokenId = _nextTokenId++;
_safeMint(msg.sender, tokenId);
// Initialize metadata for the minted token
rapperStats[tokenId] = RapperStats({
weakKnees: true,
heavyArms: true,
spaghettiSweater: true,
calmAndReady: false,
battlesWon: 0
});
+ MintedRaper(msg.sender,tokenId);
+ return tokenId;
}
Updates
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.