Snowman Merkle Airdrop

Summary

The function mintSnowman() is publicly accessible with no access restrictions. Any external user or contract can mint unlimited NFTs at any time.

Description

mintSnowman() is external and callable by anyone.
The contract lacks any kind of role-based access control.
There is no onlyOwner modifier or similar restriction to ensure only authorized parties (such as the Airdrop contract) can mint.
This exposes the entire minting mechanism to abuse.

POC

function testMintUnlimitedSnowmanPOC() public {
    vm.startPrank(bob);
    nft.mintSnowman(bob, 2);
    nft.mintSnowman(bob, 2);
    nft.mintSnowman(bob, 2);
    nft.mintSnowman(bob, 2);
    vm.stopPrank();

    assert(nft.getTokenCounter() == 8);
}

Impact

Unlimited NFT inflation.

Severity

HIGH

Likelihood

HIGH

Recommended mitigation

Introduce proper access control: Add onlyAirdrop modifier to mintSnowman.