Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Missing Mint Cap Enables Organizer to Mint Unlimited NFTs

gurmeetkalyan

Root + Impact

Description:

The mint() function allows the organizer to mint any number of tokens for any id, but no cap or supply limit is enforced. This enables infinite minting, which can lead to loss of scarcity, dilution of value, or even abuse of trust.

function mint(address to, uint256 id, uint256 amount) public {
require(msg.sender == organizer, "Not organizer");
_mint(to, id, amount, "");
}

// Root cause in the codebase with @> marks to highlight the relevant section

@> _mint(to, id, amount, ""); <@
// No cap or supply control

##Risk

Likelihood:

  • Likely to happen either accidentally or deliberately by the organizer during future festival phases or promotions.

  • Even if not currently exploited, the risk is embedded and can surface at any point.

Impact:

  • Unlimited NFTs can be minted, destroying value of existing holders’ tokens.

  • Users may lose trust in the protocol if over-minting occurs.

  • Makes it impossible to prove scarcity on-chain, defeating the purpose of NFT utility or exclusivity.

Proof of Concept

// Organizer mints 1,000,000 extra NFTs
festivalPass.mint(address(organizer), 0, 1_000_000);
// No restriction prevents this

This can be repeated across multiple ids, making NFTs inflationary and valueless.

Recommended Mitigation

Implement a supply cap per token ID:

mapping(uint256 => uint256) public totalMinted;
mapping(uint256 => uint256) public maxSupply;
​
function mint(address to, uint256 id, uint256 amount) public {
require(msg.sender == organizer, "Not organizer");
require(totalMinted[id] + amount <= maxSupply[id], "Exceeds supply cap");
totalMinted[id] += amount;
_mint(to, id, amount, "");
}

Also, initialize maxSupply for each id at deployment or via admin functions.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.