Submission Details
Severity:
No access control on `Snowman::mintSnowman` so anyone can mint snowman for free
Description
-
the
mintSnowmanfunction should only be callable bySnowmanAirdrop -
Instead anyone can call this and receive free snowmen defeating the whole purpose of staking snow tokens
// Root cause in the codebase with @> marks to highlight the relevant section
Risk
Likelihood:
anyone can easily call
mintSnowman
Impact:
-
Impact 1
-
Impact 2
Proof of Concept
add to TestSnowman.t.sol
function testMintSnowman() public {
nft.mintSnowman(alice, 1);
assert(nft.ownerOf(0) == alice);
assert(nft.balanceOf(alice) == 1);
}
Recommended Mitigation
after deploying Snowman transfer ownership to SnowmanAirdrop. add an onlyOwner modifier to Snowman::mintSnowman
Updates
Lead Judging Commences
yeahchibyke 11 days ago
Submission Judgement Published Assigned finding tags:
Unrestricted NFT mint function
The mint function of the Snowman contract is unprotected. Hence, anyone can call it and mint NFTs without necessarily partaking in the airdrop.
Rewards breakdown
nSLOC
215This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.