search

sherlock-audit / 2022-10-nftport-judging

1 stars 0 forks source link

0xNazgul - `MINTER_ROLE` Can Be Granted By The Deployer and Mint Arbitrary Amount of Tokens #107

Closed sherlock-admin closed 2 years ago

sherlock-admin commented 2 years ago

0xNazgul

medium

MINTER_ROLE Can Be Granted By The Deployer and Mint Arbitrary Amount of Tokens

Summary

Using the mintToCaller() && mintByOwner() && mintByOwnerBatch() functions of ERC721NFTProduct && ERC1155NFTProduct respectively, an address with MINTER_ROLE can mint/burn an arbitrary amount of tokens.

Vulnerability Detail

If the private key of the deployer or an address with the MINTER_ROLE is compromised, the attacker will be able to mint an unlimited amount of tokens.

Impact

This poses a serious centralization risk.

Code Snippet

ERC721NFTProduct.sol#L107, ERC1155NFTProduct.sol#L259, ERC1155NFTProduct.sol#L279

Tool used

Manual Review

Recommendation

Consider removing the MINTER_ROLE, make the NFTs only mintable by the owner, and make the ERC721NFTProduct && ERC1155NFTProduct contract to be the owner and therefore the only minter.

hyperspacebunny commented 2 years ago

This is as designed, it's what the contract/MINTER_ROLE are meant to do.