Skip to content

fix: add access control to mintEdition and batchMintEditions#9

Open
ArshLabs wants to merge 1 commit intoc2siorg:mainfrom
ArshLabs:fix/mint-edition-access-control
Open

fix: add access control to mintEdition and batchMintEditions#9
ArshLabs wants to merge 1 commit intoc2siorg:mainfrom
ArshLabs:fix/mint-edition-access-control

Conversation

@ArshLabs
Copy link
Copy Markdown

Problem

mintEdition() and batchMintEditions() in LensMintERC1155.sol have no access control. Any address can:

  1. Mint unlimited editions of any original token
  2. Bypass the maxEditions limit
  3. Create editions of tokens from devices they dont own

This breaks the core provenance model. LensMint's value prop is that every edition is cryptographically tied to the device that captured the original photo. Without this check that guarantee means nothing at the contract level.

Fix

Added UnauthorizedMinter custom error and restricted both functions to the device address stored in the original token's TokenInfo, or the contract owner.

error UnauthorizedMinter();

if (msg.sender != original.deviceAddress && msg.sender != owner())
    revert UnauthorizedMinter();

Related

Complements PR #4 (ECDSA signature verification). Together these close the two main authorization gaps in the minting flow.

mintEdition() and batchMintEditions() had no access control.
Any address could mint unlimited editions of any original token,
bypassing maxEditions limits and the device-based provenance model.

Restricted minting to:
- The device address stored in the original token's TokenInfo
  (proves hardware origin), OR
- The contract owner

Without this LensMint's core guarantee that editions are tied to the
camera that took the photo is meaningless at the contract level.
Copy link
Copy Markdown

@anurag-p6 anurag-p6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello, we don't want only owner to mint the NFT's as owner can create the multiple nft's and share QR amongst others so that they can also mint the NFT. Adding this owner constraint doesn't fit here.

refer - https://ethereum.org/developers/docs/standards/tokens/erc-1155/

thank you :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants