Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted NFT Minting Access

0xdaxun

Root + Impact

Malicious actors can mint unlimited NFTs without staking tokens.

Description

  • Normal Behavior: Only SnowmanAirdrop should mint NFTs after token verification

  • Issue: No access control allows anyone to call mint function directly

// Snowman.sol
function mintSnowman(address receiver, uint256 amount) external {
@>// No permission check - wide open access
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter++);
}
}

Risk

Likelihood:

  • Exploitable immediately after deployment

  • Requires no special privileges or conditions

Impact:

  • Infinite NFT supply inflation

  • Complete devaluation of NFT collection

  • Protocol economic model collapse

Proof of Concept

// Shows arbitrary minting by unauthorized address
function testUnrestrictedMinting() public {
address attacker = makeAddr("attacker");
uint256 arbitraryMint = 10_000;
vm.prank(attacker);
snowman.mintSnowman(attacker, arbitraryMint);
// Attacker receives NFTs without staking
assertEq(snowman.balanceOf(attacker), arbitraryMint);
}

Explanation: Any address can directly mint arbitrary NFTs without interacting with the airdrop contract or staking tokens.

Recommended Mitigation

// Snowman.sol
+ error OnlyAirdropContract();
​
function mintSnowman(address receiver, uint256 amount) external {
+ if (msg.sender != address(snowmanAirdrop)) {
+ revert OnlyAirdropContract();
+ }
// ... existing logic ...
}

Explanation: Restricts minting to only the designated airdrop contract.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted NFT mint function

The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.