First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unauthorized NFT Minting in `RamNft` Due to Lack of Access Control

4rdiii

[H-4] Unauthorized NFT Minting in RamNft Due to Lack of Access Control

Description:
The RamNft contract allows any user to mint new NFTs directly through the mintRamNFT function without any restrictions or payment requirements. This bypasses the intended flow where participants should enter through the Dussehra::enterPeopleWhoLikeRam function, undermining the game's integrity and fairness.

@> function mintRamNFT(address to) public {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
​
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}

Impact:
This vulnerability enables malicious users to mint an unlimited number of NFTs for free, significantly increasing their chances of winning while diluting the odds for legitimate participants. It disrupts the economic model of the game and can lead to unfair advantages.

Proof of Concept:
The following test case demonstrates how anyone can mint NFTs without going through the proper channels:

function test_AnyOneCanMintUsingNFTContract() public {
vm.startPrank(player1);
ramNFT.mintRamNFT(address(player1));
ramNFT.mintRamNFT(address(player1));
vm.stopPrank();
​
assertEq(ramNFT.ownerOf(0), player1);
assertEq(ramNFT.ownerOf(1), player1);
​
assertEq(ramNFT.getCharacteristics(0).ram, player1);
assertEq(ramNFT.getNextTokenId(),2);
}

Tools Used:
Manual Review

Recommended Mitigation:
To prevent unauthorized minting, implement an onlyDussehra modifier in the RamNft contract. This modifier restricts the mintRamNFT function so that only the Dussehra contract can call it, ensuring that NFTs can only be minted through the designated entry point.

+ Dussehra public dus;
+ error RamNFT__NotDussehra();
+ function setDussehra(address _dussehra) public onlyOrganiser {
+ dus = Dussehra(_dussehra);
+ }
+ modifier onlyDussehra() {
+ if (msg.sender != address(dus)) {
+ revert RamNFT__NotDussehra();
+ }
+ _;
+ }
​
- function mintRamNFT(address to) public {
+ function mintRamNFT(address to) public onlyDussehra {
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
​
Characteristics[newTokenId] = CharacteristicsOfRam({
ram: to,
isJitaKrodhah: false,
isDhyutimaan: false,
isVidvaan: false,
isAatmavan: false,
isSatyavaakyah: false
});
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

mintRamNFT is public

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.