Closed sherlock-admin3 closed 4 months ago
Escalate
Dup of #264
Escalate
Dup of #264
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Agree with the escalation, planning to accept and duplicate with #264
Result: High Duplicate of #264
nisedo
high
Edition.mintBatch()
usesmsg.value
in a for loop, allowing users to mint tokens for freeSummary
Edition.mintBatch()
usesmsg.value
in a for loop which allows to mint tokens for free.Vulnerability Detail
Using
msg.value
inside a loop is dangerous because it allows the sender to “re-use” themsg.value
(cf RareSkills blog).Edition.mintBatch()
is used to mint multiple tokens at once, paying a mint fee for each token bought.However, due to this issue, a malicious user can mint multiple tokens by paying only once for the
MintFee
.PoC
Here is the full commented PoC: https://gist.github.com/nisedo/f6ff2380f0142186a5ef80f06d8070e2
Paste it in
wallflower-contract-v2/test/nisedoTest.t.sol
and run it withforge test --mt test_nisedo_mintBatch -vvvv
Impact
Free minting of tokens.
Code Snippet
Tool used
Manual Review
Recommendation
Avoid using
msg.value
in a for loop.Result: High Duplicate of #264