Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-2] The mintSnowman function has no access checks and anyone can call it to mint an NFT for free

soarinskysagar

[H-2] The Snowman::mintSnowman() function has no access checks and anyone can call it to mint an NFT for free

Description

  • The mintSnowman() function is supposed to be called by the SnowmanAirdrop contract to mint the NFT to eligible wallets.

  • However, the function has no access control to make sure that only the Airdrop function can call it

  • As the function is right now, anyone can call the function as many times as they want and mint NFTs to their own wallets without even interacting with the Airdrop contract

@> function mintSnowman(address receiver, uint256 amount) external {
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
​
emit SnowmanMinted(receiver, s_TokenCounter);
​
s_TokenCounter++;
}
}

Risk

Likelihood:

  • Always

  • There is no restriction in calling the function

Impact:

  • NFTs can be minted for free as many times as the caller wants

  • NFTs can be minted even without being part of the airdrop

Proof of Concept

Add the following test case to the test suite of Snowman

function test_anyoneCanMint() public {
nft.mintSnowman(alice, 100);
}

Recommended Mitigation

There should be a variable that stores the address of the airdrop contract and an owner-only function to update the address of the airdrop. Then a modifier can be created and used to make sure that only the airdrop contract address can call the function

+ address public airdrop;
​
+ modifier onlyAirdrop() {
+ assert(msg.sender == airdrop);
+ _;
+ }
​
+ function changeAirdropAddress(address _airdrop) external onlyOwner {
+ airdrop = _airdrop;
+ }
Updates

Lead Judging Commences

yeahchibyke Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted NFT mint function

The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.