First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`RamNFT::mintRamNFT` can mint multiple NFT's to a single address

player

Description: The RamNFT::mintRamNFT function takes address to paramter and does not have any limit to mint a certain amount of NFT's to a single contract
As it is a public function, anyone can call it and can mint multiple NFT's. This will further cause problems in the ChoosingRam.sol::increaseValuesOfParticipants
function as an owner of multiple NFT's can increase the value of his NFT's as he would be the both challanger and participant of this function
and the

Impact: This will cause problems in the ChoosingRam.sol::increaseValuesOfParticipants function as an owner of multiple NFT's can increase the value of his NFT's
as he would be the both challanger and participant of this function. An owner of multiple NFT's can also influence the ChooseRam::selectRamIfNotSelected function.
As this function chooses selectedRam randomly, an owner of multiple NFT's will have a better chance of being chosen and getting all the money by killing Ravana.

Proof of Concept:

  1. User calls RamNFT::mintRamNFT multiple times and mints multiple NFT's

  2. By having multiple NFT's user has the privilege to call ChoosingRam.sol::increaseValuesOfParticipants multiple times only with the token Id of his own

  3. By minting multiple NFT's user has better chance of being the selectedRam, killing Ravana and getting the withdraw money for himself.

Proof of Code:

Code

Run this code snipped on Dussehra.t.sol using forge test --mt test_mintMultiple -vvvv to see the different nfts minted to Player1 .

​
function test_mintMultiple() public {
vm.startPrank(player1);
ramNFT.mintRamNFT(player1);
ramNFT.mintRamNFT(player1);
vm.stopPrank();
​
vm.warp(1728691200 + 1);
​
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected();
vm.stopPrank();
​
vm.startPrank(player1);
dussehra.killRavana();
vm.stopPrank();
​
uint256 RamwinningAmount = dussehra.totalAmountGivenToRam();
assertEq(player1.balance, RamwinningAmount);
}
​

Mitigation: There are many ways to avoid this issue. Once of them would be to create a mapping with the tokenId and contract address and check if the caller already holds and NFT everytime before minting an NFT to that address.

Tools used: manual review

Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.