Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of access control in `mintSnowman`

juanalacubana

Since there's no access control any user can just call the function mintSnowman and mint themselves a free snowman NFT.

Description

  • Users are supposed to give up their snow tokens for snowman NFTs.

  • But due to the lack of access control users can just straight up mint themselves the NFT without even giving up their snow tokens or without even getting snow tokens

@> function mintSnowman(address receiver, uint256 amount) external {
for (uint256 i = 0; i < amount; i++) {
@> _safeMint(receiver, s_TokenCounter);
​
emit SnowmanMinted(receiver, s_TokenCounter);
​
s_TokenCounter++;
}
}

Risk

Likelihood: High

  • This will occur every time time since there's no access control

Impact: High

  • Due to this users can just mint themselves whatever amount of snowman NFTs they want without staking their snow tokens or without having any at all.

  • This would cause an oversaturation of NFTs causing their value to drop

Proof of Concept

-Bob calls the function mintSnowman
-Bob inputs his address and the amount he wants
-the snowman NFT gets minted to his address

Recommended Mitigation

A good fix would be to add roles like a onlyMinter role so there could be some access control in the function

​
+ import "@openzeppelin/contracts/access/AccessControl.sol";
​
+ contract Snowman is ERC721, Ownable, AccessControl
​
+ bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");
​
constructor(string memory _SnowmanSvgUri) ERC721("Snowman Airdrop", "SNOWMAN") Ownable(msg.sender) {
s_TokenCounter = 0;
s_SnowmanSvgUri = _SnowmanSvgUri;
+ _grantRole(MINTER_ROLE, 0x3747......whatever address that can be trusted);
}
​
​
+ function mintSnowman(address receiver, uint256 amount) external onlyRole(MINTER_ROLE) {
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 16 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted NFT mint function

The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.