First Flight #15: Mondrian Wallet
First Flight #15
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

[H-2]`MondrianWallet::owner` doesn't own any Mondrian art NFT since Mondrian art NFT's are never minted

codexbugmenot

Description

The Documentation states that every owner of the wallet receives a Random Mondrian art NFT but it is never minted in the contract

Impact

The Owners will not be able to view their corresponding tokens URI since they do not own any Mondrian art NFT

Proof of Concept

The MondrianWallet contract inherits ERC721 but it doesn't mint NFT in the cnstructor nor there is a mint function in the MondrianWallet contract

Recommended Mitigation

Make the following changes in MondrianWallet::constructor

​
constructor(address entryPoint) Ownable(msg.sender) ERC721("MondrianWallet", "MW") {
i_entryPoint = IEntryPoint(entryPoint);
+ uint256 id = uint256(keccak256(abi.encode(msg.sender))) % 4;
+ _mint(msg.sender, id);
}
​

This gives every user address a random Mondrian art NFT out of the four possible Mondrian arts.
Note that for true randomness on chain using a verifiable random function like ChainlinkVRF is recommended

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

NFTs are not random

The Wallet doesn't end up owning any nft

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.