Created
July 28, 2021 00:44
-
-
Save TimTinkers/1c80b6f3cb82088b201cd71e37535f66 to your computer and use it in GitHub Desktop.
Rekt by Vogu? Here's why!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Have you lost funds to the Vogu item contract with no explanation? Here's the explanation. | |
This function in the Vogu item contract was bugged. | |
``` | |
/** | |
* @dev mint `numberToken` for msg.sender aka who call method. | |
* @param numberToken number token collector want to mint | |
*/ | |
function _mintVogu(uint256 numberToken) internal returns (bool) { | |
for (uint256 i = 0; i < numberToken; i++) { | |
uint256 tokenIndex = totalSupply(); | |
if (tokenIndex < MAX_VOGU) _safeMint(_msgSender(), tokenIndex); // This is the bad line! | |
} | |
return true; | |
} | |
``` | |
On the line marked above as the bad line, the Vogu item contract would check to make sure that fulfilling | |
the mint wouldn't create more than 7,777 Vogu. If it wouldn't, the mint occurs. Then the function returns | |
true. | |
... returns true? | |
This line should have been a guarded `require` statement that would otherwise cause the transaction to | |
fail and revert without taking funds from callers. A little `require(tokenIndex < MAX_VOGU, "sold out")` | |
would have saved the day. | |
This contract could have used a bit more time in the shop. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment