Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Snowman.mintSnowman has no access control — anyone can mint unlimited NFTs

rjrajputweb3

Root + Impact

Snowman.mintSnowman is external with no access control, so anyone can mint unlimited Snowman NFTs for free, completely bypassing the airdrop's Merkle + signature gating.

Description

Snowman.mintSnowman(address receiver, string memory snowmanUri, uint256 amount) is external with no access control (no onlyOwner, no check that the caller is the SnowmanAirdrop contract).

Risk

Likelihood: High

Impact: Any address can mint any number of Snowman NFTs to itself at zero cost. This completely bypasses the Snow token earn/buy mechanics and the Merkle-proof + signature gating of the airdrop. The NFT supply is infinitely inflatable, so the airdrop and any value attached to the NFTs are meaningless.

Proof of Concept

function testAnyoneCanMint() public {
address attacker = makeAddr("attacker");
vm.prank(attacker);
snowman.mintSnowman(attacker, "uri", 1000);
assertEq(snowman.balanceOf(attacker), 1000);
}

Recommended Mitigation

Restrict mintSnowman so only the SnowmanAirdrop contract (or the owner) can call it, e.g. store the airdrop address and require msg.sender == i_airdrop.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!