Everyone can mint token

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L58

Vulnerability details

Impact

In RabbitHoleReceipt.sol the mint function is completely unprotected and anyone can use it to mint tokens and cause other problems. This problem occurs because the onlyMinter modifier is not implemented correctly and does not actually protect the function. As a result, any address can mint new tokens. Absolutely the same problem has RabbitHoleTickets.sol contract.

Proof of Concept

RabbitHoleReceipt.sol

58: modifier onlyMinter() {
59:        msg.sender == minterAddress;
60:        _;
61:    }

RabbitHoleTickets.sol
47:     modifier onlyMinter() {
48:        msg.sender == minterAddress;
49:        _;
50:    }

Tools Used

Manual Review

Recommended Mitigation Steps

Change:

RabbitHoleReceipt.sol and RabbitHoleTickets.sol

	modifier onlyMinter() {
        msg.sender == minterAddress;
        _;
    }

To:

RabbitHoleReceipt.sol and RabbitHoleTickets.sol

	modifier onlyMinter() {
        require(msg.sender == minterAddress, "error message");
        _;
    }

[c4-judge]

kirk-baird marked the issue as duplicate of #9

[c4-judge]

kirk-baird marked the issue as satisfactory