First Flight #17: Dussehra

Summary

No Access Control for the function mintRamNFT in RamNFT.sol contract as it is Public that allows anyone to call the function and mint RamNFT.

Vulnerability Details

As explained in the documentation that function mintRamNFT - Allows the Dussehra contract to mint Ram NFTs, but for the code it is Public and no restriction for who can call it so any Malicious actor can call it

Impact

any user can call the function and mint RamNFTs without paying the entranceFee as according to function enterPeopleWhoLikeRam for Dussehra contract the user must pay the fee to mint RamNFTs

Tools Used

Manual review

Recommendations

we can make the mint function to be internal