Submission Details
Severity:
`RamNFT::mintRamNFT` has no access control, anyone can call this function and mint a NFT without payment
Summary
The mintRamNFT function lacks proper access control, allowing any user to call this function and mint Ram NFTs without going through the intended payment process thus increasing their chance of being selected as Ram.
Vulnerability Details
Proof of Concept
Setup Function:
```
function setUp() public {
vm.startPrank(organiser);
ramNFT = new RamNFT();
choosingRam = new ChoosingRam(address(ramNFT));
dussehra = new Dussehra(1 ether, address(choosingRam), address(ramNFT));
ramNFT.setChoosingRamContract(address(choosingRam));
vm.stopPrank();
}
```
Minting NFT function
```
function test_canMintNftWihtoutPayment() public {
address public player1 = makeAddr("player1");
ramNFT.mintRamNFT(player1);
assertEq(ramNFT.getCharacteristics(0).ram, player1);
}
```
Impact
High - This vulnerability allows users to bypass the payment requirement, leading to unfair distribution of Ram NFTs. This undermines the integrity of the Dussehra event.
Tools Used
Manual code review
Static analysis
Recommendations
Implement proper access control to ensure that only the Dussehra contract can call the mintRamNFT function.
Adding `onlyDussehra` modifier
// Only allow the Dussehra contract to mint Ram NFTs.
function mintRamNFT(address to) public onlyDussehraContract {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}
modifier onlyDussehraContract() {
require(msg.sender == address(dussehraContract), "Caller is not Dussehra contract");
_;
}
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.