First Flight #15: Mondrian Wallet
First Flight #15
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

There's no function to mint NFTs on `MondrianWallet

r4bbit

Summary

The MondrianWallet contract extends OpenZeppelin's EIP721, but it doesn't actually expose a function to mint NFTs which is required by inheriting contracts to provide the desired functionality.

Vulnerability Details

Inheriting EIP721 as done here alone does not give MondrianWallet the ability to mint new tokens. The project's description claims that creators of MondrianWallets will get an NFT as well, but the contract doesn't allow for creating tokens.

Impact

Users that make use of this smart account do not get what they've been promised. This potentially results in users deploying their own MondrianWallet with missing functionality, which can be considered loss of funds (transaction fees) if the user has created the wallet via a normal transaction and not via a UserOperation with factory code.

Tools Used

  • Manual review

Recommended Mitigation

Ensure MondrianWallet provides a function to actually mint tokens, such as:

function mint() external {
tokenId++;
_safeMint(msg.sender, tokenId, "");
}

If, for whatever reason, only the owner should be allowed to perform this action, then this needs to be adjusted accordingly:

function mint() external requireFromEntryPointOrOwner {
tokenId++;
_safeMint(msg.sender, tokenId, "");
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

The Wallet doesn't end up owning any nft

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.