Skip to content

There can be more purchaseIdentifiers than tokens minted#

Low Risk

Whenever someone is minting through the defaultMint function, they can specify purchaseIdentifiers which is a list of custom identifiers by minter. On lines 553 - 556 in Minting.sol we can see that each of these identifiers is assigned to one of the tokens that he is minting. However, the minter can specify more identifiers than the amount of tokens he is minting. This means that he can assign an identifier to a token that is not yet minted.

for (uint256 i = 0; i < mintRequest.purchaseIdentifiers.length;) {
    ds.customization[collectionAddress][tokenId + i].purchaseIdentifier = mintRequest.purchaseIdentifiers[i];
    unchecked { i++; }
}

Recommendation#

Consider adding a check that the length of mintRequest.purchaseIdentifiers matches the mintRequest.quantity, otherwise revert. This way minter can specify only identifiers for the tokens he is minting.