First Flight #15: Mondrian Wallet
First Flight #15
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

current tokenURI function do not return values to keep distribution equal

abhishekthakur

Summary

Unfair distribution of tokenURI due to current logic

Vulnerability Details

The current logic flaw lies in the tokenURI function. The function uses the modulus operator (%) to determine which art to return based on the tokenId. However, this approach does not ensure an equal chance for each art piece.

The tokenId % 10 operation will result in a number between 0 and 9. The function only checks for values 0, 1, and 2 to return ART_ONE, ART_TWO, and ART_THREE respectively. For all other values (3 to 9), it returns ART_FOUR. This means ART_FOUR has a 70% chance of being selected, while the other three art pieces only have a 10% chance each.
That simply means that ART_FOUR will have 70% chance, so most of the users gonna get ART_FOUR.

Impact

Unfair distribution of nft's to users

Tools Used

Manual Review

Recommendation

Use tokenId % 4 to get mod number, to ensure equal distribution.

function tokenURI(uint256 tokenId) public view override returns (string memory) {
if (ownerOf(tokenId) == address(0)) {
revert MondrainWallet__InvalidTokenId();
}
- uint256 modNumber = tokenId % 10;
+ uint256 modNumber = tokenId % 4;
if (modNumber == 0) {
return ART_ONE;
} else if (modNumber == 1) {
return ART_TWO;
} else if (modNumber == 2) {
return ART_THREE;
} else {
return ART_FOUR;
}
}
```
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

NFT's should have equal distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.