First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can call RamNFT::mintRamNFT

enchev

Summary

Anyone and not only the Dussehra contract can mint Ram NFT.

Vulnerability Details

The documentation specifies that it must be accessible only by the Dussehra contract but it can be accessed by anyone.

Impact

Anyone can mint Ram NFT without paying the fee for entering (which is done by calling Dussehra::enterPeopleWhoLikeRam).

Tools Used

Manual Review

Proof Of Concept

  1. Add the following test case in the file Dussehra.t.sol:

function test_anyoneCanMintNFT() public {
address user = address(1);
vm.prank(user);
ramNFT.mintRamNFT(user);
assertEq(ramNFT.tokenCounter(), 1);
}

  1. Run the command: forge test --mt test_anyoneCanMintNFT

Recommendations

Add logic which checks if the msg.senderis the Dussehra contract for the method RamNFT::mintRamNFT. There could be a separate method accessible only by the organiser or inject it into the constructor like this:

pragma solidity 0.8.20;
​
import {ERC721URIStorage, ERC721} from "@openzeppelin/contracts/token/ERC721/extensions/ERC721URIStorage.sol";
+ import {Dussehra} from "./Dussehra.sol";
error RamNFT__NotOrganiser();
error RamNFT__NotChoosingRamContract();
+ error RamNFT__NotDussehraContract();
- constructor() ERC721("RamNFT", "RAM") {
+ constructor(address _dussehraContract) ERC721("RamNFT", "RAM") {
tokenCounter = 0;
organiser = msg.sender;
+ dussehraContract = _dussehraContract;
}
address public choosingRamContract;
+ address public immutable dussehraContract;
+ modifier onlyDussehraContract() {
+ if (msg.sender != dussehraContract) {
+ revert RamNFT__NotDussehraContract();
+ }
+ _;
+ }
+
constructor(address _dussehraContract) ERC721("RamNFT", "RAM") {
- function mintRamNFT(address to) public {
+ function mintRamNFT(address to) public onlyDussehraContract {
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.