Project

Summary

In the OWPIdentity.sol contract, the MINTER_ROLE can mint unrestricted amount of NFTs. This is more of a design issue than an actual bug in my opinion.

The issue should not be taken lightly because this attack is the leading attack in DeFi according to this statistic: https://x.com/_iphelix/status/1855855006219690233?t=KTQYuqICOMlKM0WWso91RA&s=19

Vulnerability Details

If the private keys were compromised during the launch the attacker could mint almost all of the NFTs. Normally I wouldn't say this is an issue but from your documentation, I understand that you are not planning to use a multi-sig wallet for the owner of the contracts. I definitely don't want to say that you are incompetent and you can't store your private keys safely but private keys are getting compromised very often in this space.

Impact

Attacker could mint massive amounts of NFTs

Tools Used

Manual

Recommendations

Limit how many NFTs can the MINTER_ROLE mint. So even if the private keys were compromised the attacker couldn't destroy the entire set by minting thousands of the NFTs to himself making the entire set worth nothing.

I also think this will help with the trust of the protocol since the buyers will know exactly how many NFTs can the Dev Team mint for themselves.