First Flight #12: Kitty Connect

Summary

Shop partner can indirectly become a cat owner and mint all cats

Vulnerability Details

A shop partner can not become a cat owner as it says in mintCatToNewOwner function and thats why it is not allowing him to do so by minting a new cat. However, he can still become a cat owner by minting a new cat to an address he controlls and then transfer it to himself. Since he has the ability to mint cats, he can mint all cats and have an unfair advantage. There is no check in the safeTransferFrom function to see if the receiver is a shop partner.

Impact

Shop partner can mint all cats and have an unfair advantage.

Tools Used

Manual Review

Recommendations

Consider adding a require statement in the safeTransferFrom function to check if the receiver is a shop partner.