Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View all submissions
Previous Next
Submission Details
Severity: high
Invalid

lack of access control in mint function in raacnft.sol

Author Revealed upon completion

Summary

lack of access control in mint function in raacnft.sol

Vulnerability Details

in raacnft.sol there is a mint function that mint raac nft's because raac nft's are real world assets this function should not be public
solidity
function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }

// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Impact

users can mint raac nft without prior permission or restriction

Tools Used

vs code

Recommendations

  • consider implementing a system where user can not directly mint from raac nft

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.