First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing access control in `RamNFT::mintRamNFT` function can lead to minting NFTs for free.

mirkopezo

Summary

The mintRamNFT function in the RamNFT contract lacks access control, allowing anyone to mint NFTs without cost, which could lead to abuse and unintended distribution of tokens.

Vulnerability Details

// @audit - missing access control
@> function mintRamNFT(address to) public {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
​
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}

RamNFT::mintRamNFT function is used to mint Ram NFT, its called by Dussehra contract where player must pay for minting. Problem is that this function does not have any access control, so anyone can just call this function directly and mint Ram NFT for free.

  1. Player calls RamNFT::mintRamNFT function 10 times.

  2. Player has 10 tokens in his wallet.

  3. Player didn't pay for minting tokens.

PoC

Place the following test into Dussehra.t.sol.

function test_unlimitedFreeMintOfRamNFT() public {
vm.startPrank(player1);
​
uint256 balanceBefore = player1.balance;
​
for (uint256 i; i < 10; i++) {
ramNFT.mintRamNFT(player1);
}
​
uint256 balanceAfter = player1.balance;
​
assertTrue(balanceAfter == balanceBefore);
assertTrue(ramNFT.balanceOf(player1) == 10);
}

Impact

Player can mint Ram NFT for free unlimited times which has strong financial impact on protocol, protocol is not getting money for minting tokens.

Also player can gain advantage by minting a lot of tokens, and then playing against others, maximizing his chance some of his token to be selected Ram.

Tools Used

Manual review

Recommendations

Add access control to RamNFT::mintRamNFT function so only Dussehra contract can call that function.

+ error RamNFT__NotAuthorized();
​
+ address dussehra;
​
- constructor() ERC721("RamNFT", "RAM") {
+ constructor(address dussehra_) ERC721("RamNFT", "RAM") {
+ dussehra = dussehra_;
tokenCounter = 0;
organiser = msg.sender;
}
​
.
.
​
function mintRamNFT(address to) public {
+ if (msg.sender != dussehra) {
+ revert RamNFT__NotAuthorized();
+ }
​
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
.
.
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.