Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can mint unlimited number of tokens to any address.

flavius

Description

The mintSnowman function is declared "external" with no access control whatsoever. Any address can call it to mint as many snowman NFTs as possible to any recipient.

function mintSnowman(address receiver, uint256 amount) external {
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
​
emit SnowmanMinted(receiver, s_TokenCounter);
​
s_TokenCounter++;
}
}

Risk

Likelihood:

  • High.

    Since the function is declared external, anyone can call it without any prerequisites or on-chain cost beyond gas.

Impact:

  • High

    Unrestricted minting allows complete takeover of the NFT supply. Even legitmate NFTs might become inaccessible if the attacker keeps minting NFTs to recipients (DoS).

Proof of Concept

Append the following code to TestSnowman.t.sol and then run forge test --match-contract TestSnowman
, if all test passed it means that the user bob has minted 31800 tokens.

function testNonOwnerCanExploitUnlimitedMint() public {
vm.prank(bob);
nft.mintSnowman(bob, 31800);
assertEq(nft.balanceOf(bob), 31800);
assertEq(nft.getTokenCounter(), 31800);
}

Recommended Mitigation

Restrict access to `mintSnowman` by adding a modifier that checks if the caller is authorized or not. So only the authorized addresses can call it, otherwise it will revert. The only_Owner modifier has require statement that check if msg.sender is equal to the deployed SnowmanAirdrop contract's address:

modifier only_Owner{
require(msg.sender == airdropContractAddr, "Not Authorized");
_;
}
- function mintSnowman(address receiver, uint256 amount) external {
+ function mintSnowman(address receiver, uint256 amount) external only_Owner {
Updates

Lead Judging Commences

yeahchibyke Lead Judge 20 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted NFT mint function

The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.