Project

Summary

The NativeMetaTransaction contract inherits from EIP712BaseContext thereby allowing meta-transactions to work with its functions. It relies on a trusted minter that is set in the constructor. The trusted minteer that it depends on is the mint, which is located in the External contract. However, the mint function is not ready for production use and is mainly meant for testing.

By using the mint function, Tokens could potentially be lost. In addition, the mint's signed requests do not expire and lack batching, which is useful when dealing with a large volume of requests to be forwarded.

Vulnerability Details

Reference point Function mint

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/shared/testERC20.sol#L16

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/dao/tokens/MembershipERC1155.sol#L60

Impact

Tokens could be potentially lost

Tools Used

Manual Review

Recommendations

Consider using OpenZeppelin's ERC20 instead. While this contract is not available until v5.0 is released, the source code can be obtained from the master branch and inserted into the codebase.