GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Free NFTs Can Be Minted Due to Lack of Minimum Donation Check

4rdiii

Summary

The donate function in the GivingThanks contract lacks a check on msg.value, allowing users to mint NFTs with zero donations. This could lead to spam minting of NFTs without any actual funds going to the intended charity, diminishing the contract’s purpose.

Vulnerability Details

In the donate function, there is no minimum donation amount requirement, allowing users to pass a zero-value transaction to mint an NFT for free:

function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
(bool sent, ) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
​
_mint(msg.sender, tokenCounter);
​
// Create metadata for the tokenURI
string memory uri = _createTokenURI(
msg.sender,
block.timestamp,
msg.value
);
_setTokenURI(tokenCounter, uri);
​
tokenCounter += 1;
}

Without a minimum donation check, any user can repeatedly call this function with msg.value = 0 to obtain unlimited NFTs without donating.

Impact

  • Exploitation of NFT Minting: Users can mint NFTs at no cost, flooding the NFT supply with zero-value tokens.

  • Loss of Charity Purpose: The intended goal of generating funds for verified charities is undermined if users mint NFTs without donating.

Tools Used

Manual Review

Recommendations

Introduce a check to ensure msg.value is above zero, ideally setting a minimum donation threshold for minting NFTs. For example:

function donate(address charity) public payable {
+ require(msg.value > 0, "Donation amount must be greater than zero.");
require(registry.isVerified(charity), "Charity not verified");
(bool sent, ) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
​
_mint(msg.sender, tokenCounter);
​
// Create metadata for the tokenURI
string memory uri = _createTokenURI(
msg.sender,
block.timestamp,
msg.value
);
_setTokenURI(tokenCounter, uri);
​
tokenCounter += 1;
}

This will prevent zero-value donations, ensuring that each NFT minted corresponds to an actual contribution.

Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-0-donation-mint-an-NFT

Likelyhood: Low, anyone can mint an NFT with 0 amount. No reason to do it. Impact: Informational/Very Low, NFT are minted to a false donator. An NFT with 0 in the amount section would be useless. Since that's a bad design and not expected, I'll consider it Low but in a real contest, it could be informational because there is no real impact.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.