First Flight #15: Mondrian Wallet
First Flight #15
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing random distribution of Mondrian paintings

4th05

Summary

The 4 Mondrian paintings given to users that create an account abstraction wallet is not randomly distributed as it should.

Vulnerability Details

The tokenURI function returns one of the 4 Mondrian paintings which however is not randomly distributed to the final user. This because the distribution is based on a predictable number which is the tokenId.

function tokenURI(uint256 tokenId) public view override returns (string memory) {
if (ownerOf(tokenId) == address(0)) {
revert MondrainWallet__InvalidTokenId();
, }
uint256 modNumber = tokenId % 10;
if (modNumber == 0) {
return ART_ONE;
} else if (modNumber == 1) {
return ART_TWO;
} else if (modNumber == 2) {
return ART_THREE;
} else {
return ART_FOUR;
}
}

Impact

The statement of random distribution of the NFTs is not verified, with a direct impact on the final user that can predict the NFT painting he will receive knowing the tokenId.

Tools Used

Manual review

Recommendations

Implement a solution with a verifiable source of randomness. (Chainlink VRF)

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

NFTs are not random

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.