First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing access modifier on `RamNFT::mintRamNFT` allows anybody to mint NFTs for free.

feder

Summary

The RamNFT::mintRamNFT function is supposed to be callable only by the Dussehra contract. However, there is no access control in place, allowing anybody to call the function and mint a new NFT for free.

Vulnerability Details

According to the protocol's specification, the mintRamNFT function should only be callable by the Dussehra contract after the user has paid the entranceFee. However, in the current version of the protocol, the mintRamNFT function can be called by anybody, resulting in a free NFT mint.

// @audit Lack of access modifier
function mintRamNFT(address to) public {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
​
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}
PoC

Add the following test in test/Dussehra.t.sol.

The test shows that player1 can call the mintRamNFT function, passing no value, and mint a new NFT.

function test_mintNFT_lackOfAccessModifier() public {
vm.startPrank(player1);
ramNFT.mintRamNFT(player1);
vm.stopPrank();
​
assertEq(ramNFT.ownerOf(0), player1);
assertEq(ramNFT.getCharacteristics(0).ram, player1);
assertEq(ramNFT.getNextTokenId(), 1);
}

Impact

  • It could reduce the amount of fees collected by the protocol.

  • It could allow a malicious user to mint a large number of tokens. If the organizer executes ChoosingRam::selectRamIfNotSelected, the malicious user could have a higher chance of being randomly selected as Ram once the event has concluded.

Tools Used

Manual review.

Recommended Mitigation

Add a modifier or a require statement to ensure that the caller of the function (msg.sender) is the Dussehra contract.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.