First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing access control for mintRamNFT, allowing users to mint unlimited nfts

josh4324

Summary

The RamNFT::mintRamNFT function in the RamNFT contract lacks proper access control, allowing any user to mint NFTs without restriction. This function should be restricted to only be callable by the Dussehra contract to prevent unauthorized minting. This will allow users to bypass paying for Dussehra::enterPeopleWhoLikeRam()

Vulnerability Details

Function Affected: RamNFT::mintRamNFT

Issue: Lack of access control

Exploitation: Any user can call the mintRamNFT function, minting an unlimited number of NFTs.

Severity: Critical. Unauthorized minting of NFTs can lead to inflation of the NFT supply and other potential attacks that undermine the integrity and value of the NFTs.

POC

function test_minting() public {
vm.startPrank(player1);
​
for (uint256 i; i < 100; i++) {
ramNFT.mintRamNFT(player1);
}
​
vm.stopPrank();
​
assertEq(ramNFT.balanceOf(player1), 100);
}

Impact

Integrity: The value and uniqueness of the NFTs are compromised, as any user can mint unlimited NFTs.

Security: Unauthorized minting can lead to various attacks, including devaluation of the NFTs and exploitation of related functionalities.

Tools Used

Manual Review

Recommendations

Implement proper access control in the mintRamNFT function to ensure it can only be called by the Dussehra contract. This can be achieved by introducing a modifier that checks if the caller is the Dussehra contract

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;
​
import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";
​
contract RamNFT is ERC721URIStorage {
+ modifier onlyDussehraContract() {
+ require(msg.sender == dussehraContract, "Caller is not the Dussehra contract");
+ _;
+ }
​
- function mintRamNFT(address to) public {
+ function mintRamNFT(address to) public onlyDussehraContract {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
​
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}
}
​
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.