First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Everyone can mint NFTs in 'RamNFT'

DanielEth

Summary

All users are able to mint free nfts (without paying a dollar).

Vulnerability Details

If users are able to mint free nfts, there will be several differents problems, for example they can mint a lot of nfts for free and have a better possibility to be the ram. Also tis makes no sense because in 'Dussehra' contract (that would be the only allowed contract to mint nfts) the users need to pay a fee in order to mint an NFT.

PoC

function test_everyoneCanMintRamNFTS() public {
address casualAddress1 = address(12318);
vm.startPrank(casualAddress1);
ramNft.mintRamNFT(casualAddress1);
vm.stopPrank();
​
address casualAddress2 = address(361312);
vm.startPrank(casualAddress2);
ramNft.mintRamNFT(casualAddress2);
vm.stopPrank();
}
​

Impact

Users can mint free NFTs instead of buying them paying a fee in 'dussehra_enterPeopleWhoLikeRam()'

Tools Used

Manual Review

Recommendations

Allow only the 'Dussehra' contract to mint NFTs implementing an access control in the function 'mintRamNft'

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.