Closed code423n4 closed 2 years ago
Invalid -- it's a design choice to allow creator's to mint from their own collection.
Since this is limited to the creator already, requiring a fee would not really make a difference since the money goes right back to their wallet anyways.
Creator's may want to mint a few for themselves, as a long term play. They may also choose to airdrop some NFTs to important collectors. We wanted to remain flexible for use cases such as those.
feature, not bug
Lines of code
https://github.com/code-423n4/2022-08-foundation/blob/792e00df429b0df9ee5d909a0a5a6e72bd07cf79/contracts/NFTDropCollection.sol#L171
Vulnerability details
Impact
Detailed description of the impact of this finding.
In the following code in NFTDropCollection,
minter or admin can mint NFT for free, which is not fair to the user.
Proof of Concept
Provide direct links to all referenced code on GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
the mintCountTo Function is not payable, so minter or admin can mint NFT for free at the cost of the user.
Tools Used
Recommended Mitigation Steps
We can modifer the function signature.
to make sure no one can mint for free.