Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

HIGH ISSUE: CEI Pattern Violation in Mint Function

mostafapahlevani93

Root + Impact

Description

  • The state change (CurrenTokenID++) happens AFTER the external interaction (_safeMint). This could potentially allow reentrancy attacks.

function mint(address to) public onlyOwner returns (uint256) {
uint256 _tokenId = CurrenTokenID;
_safeMint(to, _tokenId); // External interaction
emit BidBeastsMinted(to, _tokenId); // Effect (event)
CurrenTokenID++; // Effect (state change)
return _tokenId;
}

Risk

Likelihood:

  • Reentrancy can occur when _safeMint calls the recipient's onERC721Received function

  • Malicious contracts can exploit this to manipulate the state before CurrenTokenID is incremented

  • The vulnerability exists every time a mint occurs to a contract address

Impact:

  • Potential for duplicate token IDs if reentrancy occurs

  • State inconsistency in the contract

  • Possible exploitation of mint logic

Proof of Concept

contract MaliciousReceiver {
BidBeasts nft;
constructor(BidBeasts _nft) {
nft = _nft;
}
function onERC721Received(address, address, uint256, bytes calldata)
external returns (bytes4) {
// Reentrant call during mint
// CurrenTokenID hasn't been incremented yet
uint256 currentId = nft.CurrenTokenID();
// Could potentially exploit this state
return this.onERC721Received.selector;
}
}

Recommended Mitigation

function mint(address to) public onlyOwner returns (uint256) {
uint256 _tokenId = CurrenTokenID;
+ CurrenTokenID++; // Effect first
_safeMint(to, _tokenId); // Interaction last
emit BidBeastsMinted(to, _tokenId);
- CurrenTokenID++;
return _tokenId;
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.