Submission Details
Severity:
Reentrancy in `mintRapper()`
Summary
mintRapper() function in OneShot contract uses _safemint() to mint new NFTs to msg.sender
Vulnerability Details
There is no reentrancy preventing mechanism in the function.
Impact
The impact is low the logic of the contract already allows everyone to mint as much NFTs as they want. The only effect of this vulnerability is to mint 2 NFTs calling mintRapper() function once.
contract Reentrant {
OneShot oneShot = OneShot(0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f);
IOneShot.RapperStats stats;
bool complete;
function onERC721Received(address, address, uint256, bytes calldata) external returns (bytes4) {
if (!complete) {
complete = true;
oneShot.mintRapper();
}
return IERC721Receiver.onERC721Received.selector;
}
receive() external payable {}
}
Tools Used
manual review
Recommendations
Reentrancy preventing modifier can be used.
Updates
Lead Judging Commences
inallhonesty
over 1 year ago
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
mintRapper reentrancy leads to fighting having better chances of winning.
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.