Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[M-03] Unrestricted ERC20 Minting

joaosantosjorge

Description:

The ERC20ToGenerateNftFraccion::mint function in the ERC20 contract lacks access control, allowing any user to mint tokens arbitrarily. While this does not directly break any TokenDivider functionality, it undermines the integrity of the ERC20 token by permitting unauthorized minting.
Code snippet illustrating the issue:

function mint(address _to, uint256 _amount) public {
@> _mint(_to, _amount);
}

Since the mint function is public and does not include any access restrictions, any user can call it and create tokens, even if they do not own the corresponding NFT.

Impact:

Medium: Unauthorized users can mint tokens tied to an NFT they do not own. While the TokenDivider tracks ownership, this behavior can lead to inconsistencies.

Proof of Concept:

The following test demonstrates that USER2 can mint ERC20 tokens associated with an NFT owned by USER:

function testMintMore() public {
vm.startPrank(USER);
erc721Mock.approve(address(tokenDivider), TOKEN_ID);
tokenDivider.divideNft(address(erc721Mock), TOKEN_ID, AMOUNT);
​
ERC20Mock erc20Mock = ERC20Mock(
tokenDivider.getErc20InfoFromNft(address(erc721Mock)).erc20Address
);
vm.stopPrank();
​
vm.startPrank(USER2);
erc20Mock.mint(USER2, AMOUNT);
vm.stopPrank();
}

Recommended Mitigation:

Introduce proper access control to ensure that only authorized accounts can mint ERC20 tokens. This can be achieved using OpenZeppelin’s Ownable or AccessControl modules.

- contract ERC20ToGenerateNftFraccion is ERC20, ERC20Burnable {
+ contract ERC20ToGenerateNftFraccion is ERC20, ERC20Burnable, Ownable {
constructor(
string memory _name,
string memory _symbol
) ERC20(_name, _symbol) {}
​
- function mint(address _to, uint256 _amount) public {
+ function mint(address _to, uint256 _amount) public onlyOwner {
_mint(_to, _amount);
}
}
Updates

Lead Judging Commences

fishy Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of token access control chekcs

Any person can mint the ERC20 token generated in representation of the NFT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.