Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No access control for 'mintSnowman' function

jufel

Description: Snowman::mintSnowman() has no access control mechanisms, allowing any address to call it and mint unlimited NFTs to any recipient. According to the protocol design, only the SnowmanAirdrop contract should be able to mint Snowman NFTs after proper verification of eligibility.

Impact: This vulnerability completely bypasses all the carefully designed verification systems in the SnowmanAirdrop contract, including Merkle proof verification and signature validation. An attacker could mint an unlimited number of Snowman NFTs without staking any Snow tokens, which would inflate the supply and devalue legitimate users' NFTs. Additionally, it breaks the core economic model of the protocol where users must stake Snow tokens to receive Snowman NFTs.

Recommended Mitigation: Introduce an 'onlyAirdrop' modifier tied to the SnowmanAirdrop contract or:

if (msg.sender != airdrop) revert SM__NotAllowed();
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted NFT mint function

The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.