Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone Can Mint Unlimited Snowman NFTs

hyer

Root + Impact

Description

in the Snowman.sol contract, the mintSnowman() function is declared external and lacks any access control. This means anyone can call this function to mint any number of Snowman NFTs to any address, bypassing the intended verification logic of the airdrop.

// Root cause in the codebase with @> marks to highlight the relevant section
​
function mintSnowman(address receiver, uint256 amount) external {
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}
@> // No access control: anyone can mint Snowman NFTs
​

Risk

Likelihood:

  • This will occur as soon as an attacker identifies the publicly accessible mintSnowman() function.

  • No ownership of Snow tokens, Merkle proof, or signature is required to exploit.

Impact:

  • Any user can mint an unlimited number of NFTs at zero cost, undermining scarcity and trust.

  • The economic model designed around staking Snow and gated airdrops becomes obsolete.

Recommended Mitigation

Restrict the mintSnowman() function to only be callable by the SnowmanAirdrop contract:

+ address public airdropContract;
​
+ modifier onlyAirdrop() {
+ if (msg.sender != airdropContract) {
+ revert SM__NotAllowed();
+ }
+ _;
+ }
​
+ function setAirdropContract(address _addr) external onlyOwner {
+ if (_addr == address(0)) revert SA__ZeroAddress();
+ airdropContract = _addr;
+ }
​
- function mintSnowman(address receiver, uint256 amount) external {
+ function mintSnowman(address receiver, uint256 amount) external onlyAirdrop {
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted NFT mint function

The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.