Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of Access Control in `ERC20ToGenerateNftFraccion::mint` Function

roccomania

Vulnerability Details

The ERC20ToGenerateNftFraccion::mint function is publicly accessible and any unauthorized user can call it. It allows any user to mint unlimited tokens to any address. This effectively makes the token supply unbounded and vulnerable to manipulation.

@> function mint(address _to, uint256 _amount) public {
_mint(_to, _amount);
}

Proof of Concept

Here, after an erc20 has been created by USER, USER3 was able to mint more tokens, thereby increasing the token supply and balance of USER3

function testAnyoneCanMint() public nftDivided {
ERC20Mock erc20Mock = ERC20Mock(tokenDivider.getErc20InfoFromNft(address(erc721Mock)).erc20Address);
uint256 user3TokenBalanceBefore = erc20Mock.balanceOf(USER3);
vm.startPrank(USER3);
erc20Mock.mint(USER3, AMOUNT);
uint256 user3TokenBalanceAfter = erc20Mock.balanceOf(USER3);
assertGt(user3TokenBalanceAfter, user3TokenBalanceBefore );
vm.stopPrank();
}

Impact

  • A malicious actor could mint an arbitrary number of tokens to any address, inflating the token supply.

  • The token's economic model and value can be entirely undermined.

  • Integration with other smart contracts or platforms could be compromised due to trust issues with token integrity.

Tools Used

Manual review

Recommendations

Restrict access to the mint function by adding access control mechanisms, such as OpenZeppelin's Ownable or AccessControl. So that just the TokenDivider contract can mint.

import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
​
contract ERC20ToGenerateNftFraccion is ERC20, ERC20Burnable, Ownable {
constructor(string memory _name, string memory _symbol) ERC20(_name, _symbol) {}
​
function mint(address _to, uint256 _amount) public onlyOwner {
_mint(_to, _amount);
}
}
​
Updates

Lead Judging Commences

fishy Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of token access control chekcs

Any person can mint the ERC20 token generated in representation of the NFT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.