First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unuthorized NFT Minting from `RAMNFT::mintRamNFT` function

nem0x001

Unauthorized NFT Minting from RAMNFT::mintRamNFT function

Description:

The Dussehra contract is designed to manage event participation and ensure that users pay an entrancefee to join. Upon successful payment, participants should be able to mint a Ram NFT, symbolizing their participation and eligibility for rewards. However, the current implementation of the RamNFT contract allows the mintRamNFT function to be called directly, bypassing the need to go through the enterPeopleWhoLikeRam function in the Dussehra contract.Allowing Anyone To claim the event's unique NFTs Without Paying anything

function mintRamNFT(address to) public {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
​
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}

Impact:

Anyone Can Claim the Event's NFTs Without Particpating in the event and payFees.

Proof of Concept:

  • Use the Following PoC in Dusserha.t.sol

function test_anyOneCanMintNFT()public{
vm.prank(player1);
ramNFT.mintRamNFT(player1);
assertEq(ramNFT.ownerOf(0), player1);
assertEq(ramNFT.getCharacteristics(0).ram, player1);
vm.prank(player2);
ramNFT.mintRamNFT(player2);
assertEq(ramNFT.ownerOf(1), player2);
assertEq(ramNFT.getCharacteristics(1).ram, player2);
vm.prank(player3);
ramNFT.mintRamNFT(player3);
assertEq(ramNFT.ownerOf(2), player3);
assertEq(ramNFT.getCharacteristics(2).ram, player3);
​
}

Recommended Mitigation:

  • use Access control in RamNFT::mintRamNFT function.which allow calls from Dusserha contract only

Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.