Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-2] Access Control: in ERC20ToGenerateNftFraccion::mint function

0xsnoweth

Summary

The mint function in the ERC20ToGenerateNftFraccion contract is public, meaning anyone can call it to mint an unlimited number of tokens for any address. This lack of access control can lead to token inflation, devaluation, and manipulation of the token's value, undermining the protocol's tokenomics.

Vulnerability Details

The mint function does not enforce any access control, allowing any address to mint tokens. This can be exploited by malicious actors to mint an unlimited number of tokens, leading to severe economic consequences for the protocol.

Code Snippet:

function mint(address _to, uint256 _amount) public {
_mint(_to, _amount);
}

Exploit Scenario:

Deploy the ERC20ToGenerateNftFraccion contract.

An attacker calls the mint function to mint a large number of tokens for themselves.

The attacker can now manipulate the token's value and potentially drain funds from the protocol.

Proof of Concept:

function test_UnrestrictedMint() public {
// Deploy the ERC20ToGenerateNftFraccion contract
ERC20ToGenerateNftFraccion token = new ERC20ToGenerateNftFraccion("TestToken", "TT");
​
// Attacker mints a large number of tokens
address attacker = address(0x123);
uint256 amount = 1_000_000 ether;
token.mint(attacker, amount);
​
// Check the attacker's balance
assert(token.balanceOf(attacker) == amount); // Attacker has minted 1,000,000 tokens
}

Impact

High Impact: An attacker can mint an unlimited number of tokens, leading to token inflation and devaluation.

Economic Disruption: The contract's tokenomics can be completely undermined, causing financial losses for legitimate users.

Loss of Trust: Users may lose confidence in the protocol if the token's value is manipulated

Tools Used

Manual Review

Foundry

Recommendations

Restrict the mint function to only be callable by the owner or a specific authorized address (e.g., the TokenDivider contract). Use OpenZeppelin's Ownable or AccessControl to enforce access control.

Example Implementation:

import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
​
contract ERC20ToGenerateNftFraccion is ERC20, ERC20Burnable, Ownable {
constructor(string memory name_, string memory symbol_) ERC20(name_, symbol_) {}
​
function mint(address to, uint256 amount) public onlyOwner {
_mint(to, amount);
}
}
​
Additional Considerations:
​
Use a multi-signature wallet or timelock for the owner to reduce centralization risks.
​
Emit an event when tokens are minted to improve transparency:
​
```javascript
event TokensMinted(address indexed to, uint256 amount);
emit TokensMinted(to, amount);
Updates

Lead Judging Commences

fishy Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of token access control chekcs

Any person can mint the ERC20 token generated in representation of the NFT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.