NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: high

### [M-1] `mintNft()` incorrectly uses `onlyWhenRevealed`, blocking minting during the preparation phase

Author Revealed upon completion

Description: According to the README, the preparation phase explicitly allows whitelisted users to mint NFTs before the collection is revealed. However, mintNft() is gated by the onlyWhenRevealed modifier, making it impossible to mint until after revealCollection() is called.

@> function mintNft() external payable onlyWhenRevealed onlyWhitelisted {

README: "Preparation phase [...] owner whitelists wallets that can mint NFTs"

Impact: Core protocol functionality is broken. Minting is entirely blocked during the preparation phase, violating the intended two-phase design.

Proof of Concept:

A whitelisted user attempting to mint before reveal will always revert, despite the README explicitly allowing it during the preparation phase.

Run forge test --match-test test_poc_M1 -vvv to see the following output:

[PASS] test_poc_M1_mintBlockedBeforeReveal() (gas: 73562)
PoC Test Code
function test_poc_M1_mintBlockedBeforeReveal() public {
vm.prank(owner);
nftDealers.whitelistWallet(userWithCash);
​
// README states whitelisted users can mint during the preparation phase (before reveal)
// but onlyWhenRevealed prevents it
vm.startPrank(userWithCash);
usdc.approve(address(nftDealers), 20e6);
vm.expectRevert("Collection is not revealed yet");
nftDealers.mintNft();
vm.stopPrank();
}

Recommended Mitigation: Remove the onlyWhenRevealed modifier from mintNft().

-function mintNft() external payable onlyWhenRevealed onlyWhitelisted {
+function mintNft() external payable onlyWhitelisted {

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!