Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[EVMNINJA-WW01] Authentication Bypass in NFT Minting Process

evmninja

Root + Impact

Description

In the fulfillMintRequest() function, tokens are minted to msg.sender instead of the original requester who initiated and paid for the NFT. This is a critical issue that allows anyone who can call the function to receive NFTs they did not pay for.

function fulfillMintRequest(bytes32 requestId) external {
// ...
emit WeatherNFTMinted(
requestId,
msg.sender,
Weather(weather)
);
_mint(msg.sender, tokenId);
// ...
}

Risk

Likelihood:

High likelihood.

Impact:

High impact.

Recommended Mitigation

Modify the function to mint the token to the original requester stored in the request mapping:

function fulfillMintRequest(bytes32 requestId) external {
bytes memory response = s_funcReqIdToMintFunctionReqResponse[requestId].response;
bytes memory err = s_funcReqIdToMintFunctionReqResponse[requestId].err;
​
require(response.length > 0 || err.length > 0, WeatherNft__Unauthorized());
​
if (response.length == 0 || err.length > 0) {
return;
}
​
UserMintRequest memory _userMintRequest = s_funcReqIdToUserMintReq[requestId];
uint8 weather = abi.decode(response, (uint8));
uint256 tokenId = s_tokenCounter;
s_tokenCounter++;
​
// Mint to original requester instead of msg.sender
address originalRequester = _userMintRequest.user;
emit WeatherNFTMinted(
requestId,
originalRequester,
Weather(weather)
);
_mint(originalRequester, tokenId);
s_tokenIdToWeather[tokenId] = Weather(weather);
// ... rest of the function remains unchanged
}
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of ownership check in `fulfillMintRequest` function

There is no check to ensure that the caller of the `fulfillMintRequest` function is actually the owner of the `requestId`. This allows a malicious user to receive a NFT that is payed from someone else.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.