First Flight #17: Dussehra

Summary

The protocol expects users to mint RamNFT by calling Dussehra::enterPeopleWhoLikeRam and paying the entranceFee but anyone can mint RamNFT for free by calling the RamNFT::mintRamNFT function

Vulnerability Details

The function RamNFT::mintRamNFT can be called by anyone to mint RamNFT for free

Impact

1. Anyone Can Mint RamNFT for free without Paying the entranceFee

2. Breaks the one RamNFT per address invariant i.e a user can mint two NFTs and become selectedRam by passing his tokenId's as args without worrying about randomness

3. A Malicious user can become selectedRam for Free and steal rewards

Tools Used

1. Manual Review

2. Foundry

Recommendations

The RamNFT::mintRamNFT function should only be called by the Dussehra contract which will mitigate the issue

make the following changes in RamNFT.sol

1. Declare a new Error error RamNFT__NotDussehraContract();

2. Declare a new State Variable address public dussehraContract;

3. Add a new Function

   function setDussehraContract(address _dussehraContract) public onlyOrganiser {

   dussehraContract = _dussehraContract;

   }

   ​

4. Add a new Modifier

   modifier onlyDussehraContract() {

   if (msg.sender != dussehraContract) {

   revert RamNFT__NotDussehraContract();

   }

   _;

   }

   ​

   ​

5. In the RamNFT::mintRamNFT function

Note: Add this line to Dussehra.t.sol's setup for tests to work