Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

User can spam pending NFT list by sending zero value with `trickOrTreat` function for trick scenario.

blaze

User can spam pending NFT list by sending zero value with trickOrTreat function for trick scenario.

Description:
If user can predict when trick scenario will occur, they can send zero value with the trickOrTreat function call and add the minted NFT to the pending list. Repeating this will lead to spamming of the pending list.

Recommended Mitigation:
As the function returns the excess funds, a check can be added in the beginning to allow value amounts greater than treat cost only.

function trickOrTreat(string memory _treatName) public payable nonReentrant {
Treat memory treat = treatList[_treatName];
require(treat.cost > 0, "Treat cost not set.");
+ require(msg.value >= treat.cost, "Insufficient value sent");
Updates

Appeal created

bube Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] Unlimited pending NFTs

The protocol can work correctly with more than 20000 tokens in it. It is informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.