Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Overpayment Refund Exploit Vulnerability

bareli

Summary

Attack Vector: Front-Running Refund Manipulation

  1. Attacker Approves a Large Amount

    • The attacker approves an amount much higher than the actual NFT price (e.g., NFT price = 100 tokens, but they approve 10,000 tokens).

  2. Attacker Calls mint with an Inflated _amount

    • Instead of calling mint(tokenId, 100), they call mint(tokenId, 10,000).

    • The contract accepts the 10,000 tokens and processes a refund of 9,900 tokens.

  3. Front-Running Attack to Drain Contract Funds

    • If another user or attacker can front-run the refund transaction and manipulate the balance, they might drain contract funds through repeated overpayments.

Vulnerability Details

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT_InsufficientFundsMint(); }
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Impact

Tools Used

Recommendation

This ensures that users only send the exact amount required and prevents refund manipulation.

require(_amount == price, "RAACNFT__ExactAmountRequired");

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.