First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of modifier in `mintRamNFT` function

bbash

Summary

The lack of a modifier in the mintRamNFT function allows anyone to mint a Ram NFT.

Vulnerability Details

There is no check on who is calling the mintRamNFT function.

https://github.com/Cyfrin/2024-06-Dussehra/blob/main/src/RamNFT.sol#L49

function mintRamNFT(address to) public {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
​
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}

The mintRamNFT is public and hence, can be called by anyone. There is no restriction on who can call this function. Therefore, users can directly mint a Ram NFT without paying the entry fee to join this event.

Impact

Attackers can directly mint a Ram NFT without paying any entry fee.

Tools Used

Manual Review

Recommendations

Add a modifier to this function that ensures only the authorized users can call this function.

Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.