crypto-dappy
crypto-dappy copied to clipboard
Mint function does not strictly check Vault type
Describe the bug All mint-related functions expect a paymeValut which is in standard @FungibleToken.Vault inteface. https://github.com/bebner/crypto-dappy/blob/9ad2d82b514cb62326471fb17a39540e93dc56e6/cadence/contracts/DappyContract.cdc#L211
It should strictly define the Vault type e.g @FUSD.Valut
otherwise anyone can deploy a FungibleToken and mint Dappies.
To Reproduce Steps to reproduce the behaviour:
- Deploy a FakeUSD contract and mint to self
- Create Transaction and pass
&FakeUSD.Vault
resource as payment to mintDappy - The current CrpytoDappy contract will still allow the minting
Hi @Lucklyric, great catch! 💪 As you might know, CryptoDappy is an educational app for the community - and I think what you spotted here is a great lesson to sensitise beginners for smart contract security. Would you be willing to document this process in a short video, that we could leverage for the CryptoDappy learning hub (repo / website) as a mission "Smart Contract Security"?
Dear, @bebner. I am from ChainIDE team, and our main objective is to assist developers in learning and working on dapps. We are glad to contribute to a course about Smart Contract Security on your learning hub. We might be able to make it next month, depending on our workload.