Summary

The protocol aims to mint a random NFT for new users when they create a new wallet, but in fact the protocol lacks in randomness

Vulnerability Details

The vulnerability lies in the deterministic nature of the tokenURI function's logic. By using a modulus operation on the tokenId, the function maps every 10th token to the same URI (ART_ONE), every second token to another URI (ART_TWO), and so on. This predictable pattern reduces the randomness of the output, potentially leading to vulnerabilities such as predictability of token URIs

Impact

Predictability: Attackers could predict the URI of tokens based on their IDs, which could lead to unauthorized access or manipulation of token metadata.

Tools Used

Hardhat

Recommendations

To mitigate the identified vulnerability and enhance the randomness of the tokenURI function, consider the following recommendation:

Implement something like Chainlink VRF to achive randomness.