Submission Details
Severity:
Lack of Minting Controls in mintEgg Function
Summary
The mintEgg function allows the assigned game contract to mint NFTs without any limitations. There is no restriction on the number of NFTs that can be minted, nor is there a check to ensure that a token ID has not already been used.
Vulnerability Details
function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
_mint(to, tokenId);
totalSupply += 1;
return true;
}
Impact
The assigned
gameContractcan mint an unlimited number of NFTs, leading to inflation.If
gameContractis compromised, an attacker can mass-mint NFTs.No check ensures
tokenIdis unique, leading to possible overwriting or failed transactions.
Tools Used
Maual review
Recommendations
Ensure token uniqueness before minting
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.