Pieces Protocol

Description

The ERC20ToGenerateNftFraccion contract exposes a mint(address _to, uint256 _amount) function that is declared as public without any onlyOwner or other access-control modifier. Consequently, any external party can call mint() at will, creating an unlimited supply of ERC20 tokens pegged to an NFT fraction.

Impact

1. Inflation of Fractional Supply: An attacker can mint themselves an arbitrary number of fractional tokens without owning the corresponding NFT.

2. Loss of Peg: Because anyone can inflate the supply, the token no longer accurately represents fractions of an NFT.

3. Market Manipulation: Attackers could “dump” large amounts of minted fractions into the marketplace, confusing buyers and devaluing legitimate tokens.

Attack Route

1. Malicious user calls ERC20ToGenerateNftFraccion.mint(MY_ADDRESS, 1_000_000e18).

2. The contract mints the tokens to the attacker’s address, allowing them to circumvent the entire fractioning logic in TokenDivider.

Recommendation

• Restrict access to mint().

  function mint(address _to, uint256 _amount) external onlyMinter {

  _mint(_to, _amount);

  }

  Where onlyMinter could be implemented using an Ownable pattern or by storing a trusted minter address (i.e., the main TokenDivider contract).