Submission Details
Severity:
Unrestricted Mint Function in mintSnowman
Unrestricted Mint in mintSnowman function leads to attacker mint as many NFT as he wants
Description
The
mintSnowmanfunction allows any external user to mint an arbitrary number of ERC721 tokens without restriction or validation:
// There is no modifier or check
function mintSnowman(address receiver, uint256 amount) external {
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}
Impact:
-
Any malicious user to mint unlimited NFTs to themselves.
-
Recommended Mitigation
Use onlyOwner modifier
Updates
Lead Judging Commences
yeahchibyke 5 months ago
Submission Judgement Published Assigned finding tags:
Unrestricted NFT mint function
The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.
Rewards breakdown
nSLOC
215This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.