Submission Details
Severity:
## H - 2: User able to mint multiple nfts
Description :
A user is able to mint multiple nfts
Impact :
Due to no limit on amount of nfts able to be minted, a user can mint a lot of nfts and stake them earning him huge amount of creds. This would be unfair to other users.
Proof of Concept :
Add the following test and it will pass:
function testMultipleMinting() public mintRapper {
vm.startPrank(user);
oneShot.mintRapper();
oneShot.mintRapper();
oneShot.mintRapper();
oneShot.approve(address(streets), 0);
oneShot.approve(address(streets), 1);
oneShot.approve(address(streets), 2);
oneShot.approve(address(streets), 3);
streets.stake(0);
streets.stake(1);
streets.stake(2);
streets.stake(3);
vm.stopPrank();
}
Recommended Mitigation
Add a check if the user has already staked in Streets
Limit the amount of nfts a user can mint
Limit the amount of creds a user can get from staking within a limited time period i.e. max 1 token per day, etc.
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.