Root + Impact

Description

• The mint function allows the festival contract to mint any amount of tokens to any address, with no upper limit or restriction. In a DeFi or NFT ecosystem, this is especially dangerous because a compromised or buggy festival contract can instantly destroy the token’s value by flooding the market with new tokens. This risk is amplified by the lack of any cap, rate limit, or multi-signature protection on minting.

Risk

Likelihood:

• The festival contract is a single point of trust; compromise or bugs in this contract will allow an attacker to mint unlimited tokens.

• No additional checks or rate limits exist, so a single malicious or erroneous call can cause catastrophic inflation.

Impact:

• The attacker can mint an arbitrary number of tokens, destroying the value of the token for all holders.

• The protocol’s economic model and user trust are irreparably damaged.

Proof of Concept

The following code shows how a compromised festival contract can mint the maximum possible number of tokens to an attacker, proving there is no restriction on minting:

Recommended Mitigation

To prevent this vulnerability, add a cap or rate limit to the mint function. This ensures that even if the festival contract is compromised, the damage is limited and cannot result in infinite inflation.