Search code examples
ethereumsoliditypolygonsmartcontracts

Payable amount can be changed


quick question to you. Is it possible to hide "Payable amount" from smart contract? as people can mint from smart contract and set whatever value they want. Screenshot added from Polygonscan. Anyone can enter any amount and it will allow to mint.

Thanks in advance! [1]: https://i.sstatic.net/wQ8J4.png

    function mint(uint256 _mintAmount) public payable {
    require(!paused, "the contract is paused");
    uint256 supply = totalSupply();
    require(_mintAmount > 0, "need to mint at least 1 NFT");
    require(_mintAmount <= maxMintAmount, "max mint amount per session exceeded");
    require(supply + _mintAmount <= maxSupply, "max NFT limit exceeded");

    if (msg.sender != owner()) {
        if(onlyWhitelisted == true) {
            require(isWhitelisted(msg.sender), "user is not whitelisted");
            uint256 ownerMintedCount = addressMintedBalance[msg.sender];
            require(ownerMintedCount + _mintAmount <= nftPerAddressLimit, "max NFT per address exceeded");
        }
        require(msg.value >= cost * _mintAmount, "insufficient funds");
    }

    for (uint256 i = 1; i <= _mintAmount; i++) {
      addressMintedBalance[msg.sender]++;
      _safeMint(msg.sender, supply + i);
    }
  }


  

Solution

  • Polygonscan and other blockchain explorers show the payableAmount field for all Solidity functions with the payable modifier.

    However, you can validate the received value in the contract and revert the transaction is the value is unexpected.

    function mint() public payable {
        require(msg.value == 1e18);
    }
    

    Note: msg.value is a read-only global variable returning the amount of received wei. So "1e18 wei" is "1 MATIC" (on Polygon).