Core Contracts

Summary

The RAACNFT contract is designed to facilitate the minting of NFTs tied to house prices. However, the contract documentation states that it supports "batch minting of NFTs," while the implementation does not provide any mechanism to mint multiple NFTs in a single transaction. The addNewBatch() function only increases the currentBatchSize variable but does not implement batch minting, leading to a discrepancy between the documentation and actual functionality.

Vulnerability Details

The contract includes an addNewBatch(uint256 _batchSize) function, which is supposed to facilitate batch minting. However, this function only increments the currentBatchSize state variable and does not introduce logic for minting multiple NFTs in a single transaction.

Key Observations:

• The mint(uint256 _tokenId, uint256 _amount) function only allows minting a single NFT per call.

• The addNewBatch() function merely updates currentBatchSize, with no direct effect on the minting process.

• No loop or mechanism exists in the contract to iterate over multiple token IDs and mint them in a single call.

• The documentation claims "batch minting of NFTs" is supported, but there is no evidence of batch minting logic in the contract.

Impact

• Misleading Documentation: Users and developers relying on the documentation may expect batch minting functionality that does not exist.

• Inefficiency: If a user wants to mint multiple NFTs, they must call the mint() function multiple times, leading to increased gas costs.

• Potential Business Logic Issue: If external integrations assume batch minting is available, this could cause unintended failures or inefficiencies.

Tools Used

• Manual code review

Recommendations

To resolve this issue, the contract should either:

1. Implement batch minting by modifying the mint() function to accept an array of token IDs and iterate over them:

   function mintBatch(uint256[] memory _tokenIds, uint256 _amount) public {

   for (uint256 i = 0; i < _tokenIds.length; i++) {

   uint256 price = raac_hp.tokenToHousePrice(_tokenIds[i]);

   if (price == 0) revert RAACNFT__HousePrice();

   if (price > _amount) revert RAACNFT__InsufficientFundsMint();

   token.safeTransferFrom(msg.sender, address(this), price);

   _safeMint(msg.sender, _tokenIds[i]);

   emit NFTMinted(msg.sender, _tokenIds[i], price);

   }

   }

2. Update the documentation to clarify that batch minting is not supported and that addNewBatch() only modifies a batch size variable, not actual minting behavior.