NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: high

[G-4] Blocking owner from calling `mintNft` can be done through the whitelist system

Author Revealed upon completion

Blocking owner from calling mintNft can be done through the whitelist system

Description

The contract owner is not allowed to call the mintNft function because of this line:

function mintNft() external payable onlyWhenRevealed onlyWhitelisted {
if (msg.sender == address(0)) revert InvalidAddress();
require(tokenIdCounter < MAX_SUPPLY, "Max supply reached");
@> require(msg.sender != owner, "Owner can't mint NFTs");
​
require(usdc.transferFrom(msg.sender, address(this), lockAmount), "USDC transfer failed");
​
tokenIdCounter++;
​
collateralForMinting[tokenIdCounter] = lockAmount;
_safeMint(msg.sender, tokenIdCounter);
}

This check will be performed on every mint and will increase the transaction cost. However, the protocol already implements a whitelist system to restrict the access to mintNft. If the owner is not whitelisted, he will not be able to mint an NFT, which is the case by default.
If we want to make sure that the owner account will never be able to mint an NFT, we can block the owner from whitelisting his own address, through the whitelistWallet function.
However, this will not stop the owner from creating another account that he can whitelist to mint an NFT.

Recommended Mitigation

Perform the check in the whitelistWallet function:

function whitelistWallet(address _wallet) external onlyOwner {
+ require(_wallet != owner, "Owner can't mint NFTs")
whitelistedUsers[_wallet] = true;
}
​
function mintNft() external payable onlyWhenRevealed onlyWhitelisted {
if (msg.sender == address(0)) revert InvalidAddress();
require(tokenIdCounter < MAX_SUPPLY, "Max supply reached");
- require(msg.sender != owner, "Owner can't mint NFTs");
​
require(usdc.transferFrom(msg.sender, address(this), lockAmount), "USDC transfer failed");
​
tokenIdCounter++;
​
collateralForMinting[tokenIdCounter] = lockAmount;
_safeMint(msg.sender, tokenIdCounter);
}

This will NOT prevent the owner from minting NFTs through anothre whitelisted account.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!