Submission Details
Severity:
ERC20ToGenerateNftFraccion mint() function is publicly accessible
Summary
ERC20ToGenerateNftFraccion::mint() function is publicly accessible and can be called by anyone,
which renders the token useless as anyone can mint as much tokens as they want.
Vulnerability Details
Anyone knowing the address of a given NFT in the contract can call TokenDivider::getErc20InfoFromNft with the NFT address to get the erc20Address and mint as much ERC20 tokens as they like. This leaves buyers with no incentive to buy ERC20s as they can just mint them.
Impact
High
Tools Used
Manual review
Recommendations
Restrict access to the mint function. One way to do this could be via access modifiers to allow only the owner contract TokenDivider to call the mint function.
Updates
Lead Judging Commences
fishy 5 months ago
Submission Judgement Published Assigned finding tags:
Lack of token access control chekcs
Any person can mint the ERC20 token generated in representation of the NFT
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.