Summary

The claimNft function in TokenDivider.sol lacks proper access control mechanisms, allowing any external address to claim NFTs without restrictions.

Vulnerability Details

The claimNft function is defined as an external function, which means it can be called by any external address. There are no checks on the caller's identity or permissions before executing the function logic.

Impact

Proof of Concept:

An attacker with malicious intent could call this function with any NFT address, potentially claiming NFTs that belong to other users or the contract itself.

// An attacker calls the function with a known NFT address
claimNft(0x1234567890123456789012345678901234567890);

Tools Used

manual review

Recommendations

Implement proper access control mechanisms to ensure only authorized addresses can claim NFTs. This could include:

1. Checking if the caller is the owner of the NFT