First Flight #5: Santa's List

Summary

SantasList ERC721 tokens have the same token URI. The token image saving mechanism is very gas expensive.

Vulnerability Details

SantasList::tokenURI() returns the same token URI for every given tokenId. This suggests that all SantasList ERC721 tokens correspond to the same asset. Further more, the tokenURI is an actual image saved in base64 image format. This is bad for gas as we need to save the entirety of that base64 string on chain. Given that base64 is not the most efficient encoding when it comes to file sizing

Impact

SantasList::tokenURI() misleads the caller of the function into believing that all token IDs correspond to the same asset.

Tools Used

Manual review

Recommendations

In addition to returning a tokenURI corresponding to the current tokenId, we should save the actual image on an off-chain mechanism ( say IPFS ) and only save the url to that off-ressource. This mechanism saves on gas.