Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Staking Verification Allows Unrestricted Minting of Snowman NFTs

joewi

Description

The Snowman::mintSnowman function allows unrestricted minting of Snowman NFTs without verifying if the receiver is a Snow token staker. This directly contradicts the intended design where only Snow token stakers should receive these NFTs, potentially allowing unlimited unauthorized NFT creation.

Impact

Any user can mint an unlimited number of Snowman NFTs without staking Snow tokens, violating the protocol's tokenomics, fairness, and intended scarcity. This opens the protocol to abuse, manipulation, and devaluation of the NFT supply.

Proof of Concept

  1. Any user can call Snowman::mintSnowman directly.

  2. The caller can specify any recipient address and any amount to be minted.

  3. NFTs are minted without any staking verification.

Recommended Mitigation

Introduce staking verification and minting limitations to enforce proper eligibility checks:

  1. Add a cap on the maximum number of NFTs a user can mint in a single call.

  2. Import the Snow token contract into Snowman to verify staking balances.

  3. Ensure that the receiver holds the minimum required Snow tokens before minting.

+ uint256 private constant MAX_MINT_AMOUNT;
+ uint256 private constant MIN_STAKING_AMOUNT;
​
+ Snow public immutable snow; // Snow token contract
+ constructor(address snowAddress) {
+ snow = Snow(snowAddress);
+ }
​
function mintSnowman(address receiver, uint256 amount) external {
for (uint256 i = 0; i < amount; i++) {
+ // Check if receiver has minimum required Snow tokens
+ require(snow.balanceOf(receiver) >= MIN_STAKING_AMOUNT, "S__InsufficientSnow");
+ require(amount <= MAX_MINT_AMOUNT, "S__ExceedsMaxMint");
+ s_TokenCounter++; // follow CEI to prevent reentrancy attacks
_safeMint(receiver, s_TokenCounter);
​
emit SnowmanMinted(receiver, s_TokenCounter);
​
- s_TokenCounter++;
}
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 8 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted NFT mint function

The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.