First Flight #17: Dussehra

Summary

The RamNFT::mintRamNFT function marked as public, allowing anyone to mint a new RamNFT. This vulnerability goes against the intended behavior described in the README.md file, where users should receive a RamNFT upon entering the Dussehra event by calling the Dussehra::enterPeopleWhoLikeRam` function.

Vulnerability Details

Since the function is marked as public, any external account can call this function and mint a new RamNFT for any address specified in the to parameter.

Impact

Users can bypass the intended process of entering the Dussehra event and receiving a RamNFT token. Malicious actors could mint RamNFT tokens for themselves or others without participating in the event and paying the required entrance fee. This could lead to unauthorized access to the event and potential exploitation of the system.

Tools Used

Manual review.

Recommendations

The RamNFT::mintRamNFT function should be marked as internal.