Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

`BidBeasts:mint` function has an obvious reentrancy vulnerability.

minos

BidBeasts:mint function has an obvious reentrancy vulnerability.

Description

  • Typically, an NFT minting function should only mint one token for one user per call.

  • However, the logic in the BidBeasts:mint function does not follow the Checks-Effects-Interactions (CEI) pattern, allowing the operator (admin) to perform a reentrancy attack to mint tokens for multiple users in a single transaction.

  • BidBeasts.sol is as follows:

function mint(address to) public onlyOwner returns (uint256) {
uint256 _tokenId = CurrenTokenID;
@> _safeMint(to, _tokenId);
@> emit BidBeastsMinted(to, _tokenId);
@> CurrenTokenID++;
return _tokenId;
}

Risk

Likelihood:

  • The admin may face the possibility of a reentrancy attack each time they perform a minting operation.
    Impact:

  • If the admin is malicious, they could create a false scenario where NFTs are minted for multiple users in a single transaction.

  • In most cases, victims can easily identify the issue because the NFT is not received.

  • However, such an obvious code issue may make the NFT contract appear poorly designed, deterring average users.

Proof of Concept

  • None

Recommended Mitigation

  • Follow the CEI pattern.

function mint(address to) public onlyOwner returns (uint256) {
uint256 _tokenId = CurrenTokenID;
- _safeMint(to, _tokenId);
- emit BidBeastsMinted(to, _tokenId);
CurrenTokenID++;
+ emit BidBeastsMinted(to, _tokenId);
+ _safeMint(to, _tokenId);
return _tokenId;
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!