First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Producers can mint infinite tokens and cannot be removed

n0kto

Description

It doesn't exist any function to remove a producer in the MartenitsaToken.
Producers can mint infinite Martenitsa tokens, a corrupted/bad producers could try to mint a huge amount/the total supply to be the only one winning money with this protocol.
Since they will be a lot of producers, the probabily that one of them lose their key or become corrupted is more likely.

function createMartenitsa(string memory design) external {
require(isProducer[msg.sender], "You are not a producer!");
require(bytes(design).length > 0, "Design cannot be empty");
​
uint256 tokenId = _nextTokenId++;
tokenDesigns[tokenId] = design;
countMartenitsaTokensOwner[msg.sender] += 1;
​
emit Created(msg.sender, tokenId, design);
_safeMint(msg.sender, tokenId);
}

Risk

Likelyhood: Low

  • Any bad producer (corrupted or losing their keys).

Impact: High

  • Mint all the supply to prevent other producers to sell their tokens.

Recommended Mitigation

  • Implement a threshold for producers

  • Alternatively, add a function to remove producers if they become acting badly.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.