Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Arithmetic underflow in MembershipERC1155.sol::mint and burn_ function

aye__aye

Summary

In the MembershipERC1155::mint(address to, uint256 tokenId, uint256 amount) function, the lack of validation on the tokenId parameter introduces a potential vulnerability. Specifically, there is no check to ensure that tokenId falls within a valid range, leading to risks of underflow and overflow in the calculation that updates totalSupply.

The totalSupply variable is updated in the mint function as follows:

`totalSupply += amount * 2 ** (6 - tokenId)`

If tokenId is greater than 6, the exponent (6 - tokenId) becomes negative. Since 2 ** (6 - tokenId) evaluates to zero for invalid tokenId values, this causes the result of amount * 2 ** (6 - tokenId) to be zero. Consequently, an underflow occurs, and totalSupply may be decremented instead of incremented, disrupting the intended total supply balance.

Vulnerability Details

=>Poc

This test was done using foundry,you need foundry on your machine to run this test.
to run this test , use the command ```forge test --mt testmint`

​
​
```
contract TestmembershipERC1155 is Test {
MembershipERC1155 token;
ERC20Mock mock;
address user = makeAddr("user");
​
function setUp() external {
token = new MembershipERC1155();
mock = new ERC20Mock();
​
string memory name = "token";
string memory symbol = "tkn";
string memory url = "url";
ERC1967Proxy proxy = new ERC1967Proxy(
address(token),
abi.encodeWithSignature(
"initialize(string,string,string,address,address)", name, symbol, url, address(this), address(mock)
)
);
token = MembershipERC1155(address(proxy));
}
​
function testmint() public {
token.mint(user, 7, 1e18);
}
}
```
​

Logs:-

Ran 1 test for test/testMembershipERC1155test.t.sol:TestmembershipERC1155
[FAIL: panic: arithmetic underflow or overflow (0x11)] testmint() (gas: 15179)
Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 13.29ms (115.12µs CPU time)

Impact

** 1. Minting Failure**: If a tokenId greater than 6 is used, totalSupply becomes inconsistent with the actual number of tokens minted, causing the minting operation to fail.

2.DAO Limitations: This vulnerability restricts the DAO creator’s ability to mint tokens with tokenIds above 6, which may be critical if the contract is intended to support a broader range of token IDs.

Tools Used

manual review

Recommendations

1.Check the tokenId in the mint()function and revert the function call if the Id is greater than 6.

2.since the user cannot mint tokenId's greater than 6, the burn_function does not underflow but it is reccomened to check the tokenIdin the burn_function also

```diff
function mint(address to, uint256 tokenId, uint256 amount) external override onlyRole(OWP_FACTORY_ROLE) {
+ if (tokenId > 6) revert TokenIdCantBeGreaterThanSix();
totalSupply += amount * 2 ** (6 - tokenId); // Update total supply with weight
_mint(to, tokenId, amount, "");
}
​
```
```
function burn_(address from, uint256 tokenId, uint256 amount) internal {
+ if (tokenId > 6) revert TokenIdCantBeGreaterThanSix();
totalSupply -= amount * 2 ** (6 - tokenId); // Update total supply with weight
_burn(from, tokenId, amount);
}
```
​
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.