Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of Access Control Leading to Unrestricted Minting Privilege

troglodytsec

Root + Impact

The mintSnowman() function lacks any access control mechanism, allowing any external address to mint an arbitrary number of Snowman NFTs.

Description

Malicious actors can mint unlimited NFTs for themselves or others, completely bypassing intended distribution mechanisms. That means that the NFT's scarcity and value can be destroyed by infinite supply inflation.

Protocol governance tokens or rewards tied to NFT ownership can be exploited unfairly.

Key Issues

  • No checks on msg.sender allows any EOA or contract to call the function

  • The receiver parameter isn't validated (could be zero address)

The receiver parameter isn't validated (could be zero addrefunction mintSnowman(address receiver, uint256 amount) external {
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}

Risk

Likelihood: High

  • Can be minted at any time

  • Can be minted in any amount

Impact: High

  • Unlimited Snowman amounts can be minted

  • Users will not need to buy snow anymore, breaking the protocol's core logic.

Proof of Concept

​

Recommended Mitigation

Implement strict access control to restrict minting to only the authorized SnowmanAirdrop contract:

function mintSnowman(address receiver, uint256 amount) external {
+ if(msg.sender != s_snowmanAirdrop) revert SM__NotAllowed();
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 10 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted NFT mint function

The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.