Summary

The 4 Mondrian paintings given to users that create an account abstraction wallet is not equally distributed as it should.

Vulnerability Details

The tokenURI function returns one of the 4 Mondrian paintings which however is not equally distributed to the final user.
Due to the last else in the function, all tokenIds such that tokenId % 10 is >= 3 will have the same painting, that is ar://n17SzjtRkcbHWzcPnm0UU6w1Af5N1p0LAcRUMNP-LiM.

Impact

The statement of equal distribution of the NFTs is not verified, with a direct impact on the final user that can predict the NFT painting he will receive knowing the tokenId.

Tools Used

Manual review

Recommendations

Change the last else statement in order to have an equal distribution of the NFTs.