Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of batch minting functionality in `RAACNFT` contract

0xlouistsai

Summary

The RAACNFT contract does not implement batch minting functionality, which is inconsistent with the protocol's documentation.

Vulnerability Details

According to the RAACNFT documentation, batch minting should be a supported feature. However, the contract only provides a single NFT minting function.

Implementation Details

The RAACNFT is implemented in the RAACNFT.sol contract.

Key features of the implementation include:

  • Inherits from ERC721, ERC721Enumerable, and Ownable

  • Uses an external contract (IRAACHousePrices) to determine house prices

  • Implements batch minting functionality -> Not Implemented

  • Uses SafeERC20 for secure token transfers during minting

  • Allows setting of base URI for token metadata

Documentation Reference: https://github.com/Cyfrin/2025-02-raac/blob/main/docs/core/tokens/RAACNFT.md#implementation-details

Impact

  • Inconsistency with Documentation**:** The absence of batch minting contradicts the protocol's expected behavior.

  • The contract lacks a batchMint function that allows users to mint multiple NFTs in a single transaction.

  • The addNewBatch function only increases the currentBatchSize but does not enable batch minting of NFTs.

  • The absence of batch minting functionality forces users to call mint repeatedly, leading to increased gas costs and inefficiencies.

Tools Used

Manual Review

Recommendations

Implement a batchMint function to allow users to mint multiple NFTs in a single transaction. Below is a suggested implementation:

function batchMint(uint256[] memory _tokenIds) public {
uint256 totalAmount = 0;
​
for (uint256 i = 0; i < _tokenIds.length; i++) {
uint256 price = raac_hp.tokenToHousePrice(_tokenIds[i]);
if (price == 0) { revert RAACNFT__HousePrice(); }
totalAmount += price;
_safeMint(msg.sender, _tokenIds[i]);
​
emit NFTMinted(msg.sender, _tokenIds[i], price);
}
token.safeTransferFrom(msg.sender, address(this), totalAmount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.