First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`RamNFT::mintRamNFT` lacks access control, allows anyone to mint RamNFT.

brutalclowney

Description the RamNFT::mintRamNFT function lacks any access control and therefore is callable by anyone, meaning anyone to mint RamNFT's.

function mintRamNFT(address to) public {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
​
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}

as this is a public function, anyone with the function calldata can call this function and mint as many NFTs as they want. As per the documentation this should only be callable by the Dussehra contract.

Impact Many NFTs could be minted to users that are not operating within the protocol as intended.

Proof of Concepts (Proof of Code)
Add the following code to Dussehra.t.sol

function testAnyoneCanMintNft() public {
address anyone = makeAddr("anyone");
vm.startPrank(anyone);
ramNFT.mintRamNFT(anyone);
vm.stopPrank();
assert(ramNFT.ownerOf(0) == anyone);
}

Recommended mitigation As this function is only intended to be called by the Dussehra contract consider adding an onlyDussehra modifier to the contract as such:

add a state variable:

address public dussehraContract;

add a function to set the dussehra contract by the organiser:

function setDussehraContract(address _dussehraContract) public onlyOrganiser {
dussehraContract = _dussehraContract;
}

add the modifer:

modifier onlyDussehra() {
if (msg.sender != dussehraContract) {
revert RamNFT__NotDussehra();
}
_;
}

add the modifier to the function:

function mintRamNFT(address to) public onlyDussehra {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
​
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.