Submission Details
Severity:
attacker can mint free NFT by passing his own charity address to `donate` function
Summary
any user just after verifying their charity address can mint unlimited nfts
Vulnerability Details
once user verified its charity by admin then user can send ether to its own charity can mint unlimited nfts
Impact
Tools Used
Manual
##POC
attacker register his own charity on charityRegistery
function registerCharity(address charity) public {
registeredCharities[charity] = true;
}
admin verify his charity contract
function verifyCharity(address charity) public {
require(msg.sender == admin, "Only admin can verify");
require(registeredCharities[charity], "Charity not registered");
verifiedCharities[charity] = true;
}
call donate function using own charity address
function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
_mint(msg.sender, tokenCounter);
// Create metadata for the tokenURI
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
tokenCounter += 1;
}
Recommendations
function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
+ require(msg.sender != charity);
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
_mint(msg.sender, tokenCounter);
// Create metadata for the tokenURI
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
tokenCounter += 1;
}
Updates
Lead Judging Commences
n0kto 7 months ago
Submission Judgement Published Assigned finding tags:
finding-charities-can-get-big-amount-NFT-for-free
Likelyhood: Informational/Very low, admin will verified the contract. Impact: High, NFT with real value for free. I accept this one has a Low due to its High Impact.
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.