Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`ERC20ToGenerateNftFraccion` is open for anyone to mint to any address

vincent71399

Description:

The ERC20ToGenerateNftFraccion contract has a mint function that allows anyone to mint tokens to any address.
making the total supply of the token inconsistent with the actual amount of NFTs divided.

function mint(address to, uint256 amount) public {
require(msg.sender == owner, "only owner can mint");
_mint(to, amount);
}

Impact:

currently tokenDivider uses local state to manage the fractional token balance, this free mint does not directly break the function,
but recommend to remove this function to avoid potential misuse.

Recommended Mitigation:

remove the mint function in ERC20ToGenerateNftFraccion contract, instead, mint the token in the constructor. So the total supply of the token is fixed at the actual amount of NFTs divided.

Updates

Lead Judging Commences

fishy Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of token access control chekcs

Any person can mint the ERC20 token generated in representation of the NFT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.