First Flight #15: Mondrian Wallet

Summary

This submission details a critical vulnerability in the MondrianWallet smart contract, specifically related to the inability of users to mint NFTs. The issue arises due to the absence of a function dedicated to the minting process within the contract. As a result, users are unable to generate and own the NFTs promised by the MondrianWallet.

Vulnerability Details

The MondrianWallet smart contract, designed to offer users a unique account abstraction wallet combined with random Mondrian art NFTs, lacks a crucial functionality, the ability to mint NFTs. The code provided does not include a method to facilitate the minting process, preventing users from obtaining the NFTs that are an integral part of the project’s value proposition.

PoC

To address the vulnerability where users are unable to mint NFTs in the MondrianWallet contract, we conducted a comprehensive analysis of the entire contract and its functions. Our examination revealed the following critical insights:

1. Examination of the MondrianWallet contract confirms that the _mint and _safeMint functions are internal.

2. No external functions exist in the contract that would enable users to trigger minting.

3. Attempting to call the _mint or _safeMint functions externally results in a compilation error due to their internal visibility.

These tests aim to verify whether it is possible to mint NFTs by attempting to call the internal _mint and _safeMint functions externally.

However, since these functions are defined as internal within the contract, they cannot be accessed externally, leading to compilation errors during testing. The encountered errors indicate that the functions are not callable externally, resulting in the test failures.

Impact

The absence of the ability to mint NFTs directly impacts the interaction between users and the MondrianWallet protocol. Users are unable to obtain the expected NFTs, which will result in a loss of trust and engagement with the platform.

Tools Used

1. Manual code review.

2. Hardhat

Recommendations

To resolve the issue of users being unable to mint NFTs in the MondrianWallet smart contract, it is recommended to implement the internal _mint function within the contract. This can be done by either creating a new public or external function that utilizes _mint, or by integrating _mint into an existing function, depending on the desired functionality of the code. Additionally, a new variable, such as tokenIdCounter, should be introduced to keep track of the tokens minted and automatically increment after each mint. It is also essential to maintain a record of the users who have already minted an NFT to ensure accurate tracking and prevent duplicate minting.