rmrk-team / rmrk-ink

RMRK ink! contract
Apache License 2.0
33 stars 13 forks source link

Over-guarded minting methods #66

Open boyswan opened 1 year ago

boyswan commented 1 year ago

Currently we set access control on minting trait methods by default, protecting methods from unauthorized access.

#[modifiers(only_role(CONTRIBUTOR))]
default fn mint(&mut self, to: AccountId, token_id: Id) -> Result<()> {
    self._check_amount(1)?;
    self._mint_to(to, token_id)?;
    Ok(())
}

However this means the guarded methods cannot be used from within a user-facing method of the contract, for example:

// ...Rmrk contract

#[ink(message, payable)]
pub fn public_mint_example(&mut self) -> Result<()> {
    // minting logic
    Minting::mint(self, Self::env().caller());
}

In this case, mint can only be called by a contributor. The only way around this is to call it from another contract which has been granted the contributor role.

Some possible solutions are:

boyswan commented 1 year ago

This issue is also exacerbated by the removal of mint_many in the core implementation in https://github.com/rmrk-team/rmrk-ink/pull/65.

In order to mint multiple tokens in a single transaction, a user will need to call mint in a for-loop, which would be multiple cross-contract calls and very expensive.