Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ERC20ToGenerateNFTFraccion

dayeneris1

Summary

The ERC20ToGenerateNFTFraccion contract contains several critical vulnerabilities related to access control and token supply management.

Vulnerability Details

  1. mint() function publicly acceccible without restrictions

  2. No maximum cap for total supply

  3. Lack of access control mechanism(like Ownable)

  4. No emergency pause mechanism

Impact

  • CRITICAL: Unlimited token creation by anay user

  • HIGH : Risk of token devaluation through unlimited minting

  • HIGH : No control over sensitive operations

Tools Used

  • Manual code review

  • ERC20 security best practices review

Recommandations

Here's the corrected code with recommended improvements:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.18;
​
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
import {Pausable} from "@openzeppelin/contracts/security/Pausable.sol";
​
contract ERC20ToGenerateNftFraccion is ERC20, ERC20Burnable, Ownable, Pausable {
uint256 public constant MAX\_SUPPLY = 1000000 \* 10\*\*18; // 1 million tokens
​
constructor(string memory _name, string memory _symbol) ERC20(_name, _symbol) {
}
​
function mint(address _to, uint256 _amount) public onlyOwner whenNotPaused {
require(_to != address(0), "Cannot mint to zero address");
require(totalSupply() + _amount <= MAX_SUPPLY, "Would exceed max supply");
_mint(_to, _amount);
}
​
function pause() external onlyOwner {
_pause();
}
​
function unpause() external onlyOwner {
_unpause();
}

}

Updates

Lead Judging Commences

juan_pedro_ventu Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of token access control chekcs

Any person can mint the ERC20 token generated in representation of the NFT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.