Submission Details
Impact:
Likelihood:
`mintNFT` and `buy` methods are payable for no apparent reason
Author Revealed upon completion
Root + Impact
Description
mintNft() and buy() are both payable, which allow the callers to send ETH to the contract.
Risk
Even though the interaction of this contract assumes both buyers and sellers to transact in USDC, the payable modifier opens up the possibility for users to set msg.value and send ETH to the contract, with no refund mechanism. Even the contract owner would not be able to withdraw trapped ETH.
Recommended Mitigation
Remove payable modifiers from both mintNft() and buy() methods.
Rewards breakdown
nSLOC
253This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.