Beginner FriendlyFoundryNFT
100 EXP
View results
Submission Details
Severity: medium
Valid

Incorrect Token URI for Legendery Snek

[H-1] Incorrect Token URI for Legendery Snek

Description:
The smart contract assigns a token URI to each minted token, which is intended to point to a JSON file containing metadata for the token. However, for tokens of legendary snek rarity, the token URI is incorrectly set to point to an image file of rare snek instead of a JSON file.

Impact:
This will lead to minting a wrong NFT for the legendary snek.

Proof of Concept:

Upon opening the RARE_SNEK_URI IPFS link, a JSON file is retrieved that contains metadata for a rare snek token, including its name, description, image, and attributes. The JSON file is as follows:

{
"name": "Jungle Snek",
"description": "An adorable rare jungle snek!",
"image": "ipfs://QmRujARrkux8nsUG8BzXJa8TiDyz5sDJnVKDqrk3LLsKLX",
"attributes": [
{
"trait_type": "cuteness",
"value": 100
}
]
}

However, the LEGEND_SNEK_URI IPFS link also points to the "image" ipfs of the RARE_SNEK_URI , indicating that the wrong content is being used for legendary snek tokens. This discrepancy is evident in the following code snippet:

COMMON_SNEK_URI: public(constant(String[53])) = "ipfs://QmSQcYNrMGo5ZuGm1PqYtktvg1tWKGR7PJ9hQosKqMz2nD"
RARE_SNEK_URI: public(constant(String[53])) = "ipfs://QmZit9nbdhJsRTt3JBQN458dfZ1i6LR3iPGxGQwq34Li4a"
LEGEND_SNEK_URI: public(constant(String[53])) = "ipfs://QmRujARrkux8nsUG8BzXJa8TiDyz5sDJnVKDqrk3LLsKLX"

Recommended Mitigation:
To resolve this issue, the contract should ensure that each type of snek token has a unique IPFS URI that points to its specific metadata and image. This can be done by updating the LEGEND_SNEK_URI constant to point to the correct JSON file for legendary snek tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

LEGEND_SNEK_URI is wrong

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

LEGEND_SNEK_URI is wrong

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.