Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

DoS risk in `RAACNFT::mint()` function due to front-running

patitonar

Summary

The mint function in RAACNFT contract is vulnerable to front-running attacks, allowing malicious actors to deny service to legitimate users by intercepting their mint transactions.

Vulnerability Details

The mint function accepts a user-specified _tokenId that the user wants to mint. This creates an opportunity for attackers to front-run legitimate transactions by:

  • Monitoring the mempool for mint transactions

  • Copying the transaction with a higher gas price

  • Minting the same NFT before the original user

  • Causing the original transaction to fail

The issue is particularly problematic because:

  • Users can't guarantee they'll receive their desired NFT

  • Malicious actors can systematically front-run all mint transactions

  • No protection mechanisms are implemented

Impact

This vulnerability:

  • Can effectively DoS the minting process for legitimate users

  • Damages user experience and platform reliability

  • May lead to user financial losses due to failed transactions and gas costs

  • Could render the minting functionality practically unusable for regular users

Tools Used

Manual review

Proof of Concept

Add the following test case to the test/unit/core/tokens/RAACNFT.test.js file:

it("demonstrates front-running DoS vulnerability", async () => {
const legitUser = user1;
const attacker = user2;
​
// legitUser approves 1000 crvUSD
await crvUSD.connect(legitUser).approve(raacNFT.getAddress(), ethers.parseEther("1000"));
​
// attacker approves 1000 crvUSD
await crvUSD.connect(attacker).approve(raacNFT.getAddress(), ethers.parseEther("1000"));
​
​
// Attacker front-runs user1's transaction
const tx1 = raacNFT.connect(attacker).mint(TOKEN_ID, HOUSE_PRICE);
const tx2 = raacNFT.connect(user1).mint(TOKEN_ID, HOUSE_PRICE);
await tx1;
await expect(tx2).to.be.revertedWithCustomError(raacNFT, "ERC721InvalidSender");
​
expect(await raacNFT.ownerOf(TOKEN_ID)).to.equal(attacker.address);
});

Recommendations

Consider implement merkle tree pre assigning the NFTs to users by some owner role, or include a message signed off-chain by some authenticated authority, or remove the _tokenId parameter and use a random number generator to select the NFT to mint.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.