First Flight #15: Mondrian Wallet
First Flight #15
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`TokenURI` of the NFTs can be predicted before minting them. So, it is not random and not equal distributed.

naman1729

Summary

  • User can predict the tokenURI of the NFTs before minting them by using the tokenId of the NFTs. So, it is not random and not equal distributed as mentioned in the documentation.

Vulnerability Details

  • Users can predict the tokenURI of the NFTs before minting them by using the tokenId of the NFTs.

  • The tokenURI of the NFTs is not random and not equal distributed.

  • A random number should be used to determine by Off-chain or Chainlink VRF to determine the tokenURI of the NFTs.

function tokenURI(uint256 tokenId) public view override returns (string memory) {
if (ownerOf(tokenId) == address(0)) {
revert MondrainWallet__InvalidTokenId();
}
@> uint256 modNumber = tokenId % 10;
if (modNumber == 0) {
return ART_ONE;
} else if (modNumber == 1) {
return ART_TWO;
} else if (modNumber == 2) {
return ART_THREE;
} else {
return ART_FOUR;
}
}

POC

  • We can predict the tokenURI of the NFTs before minting them by using this calculation.

  • for example, if we have a tokenId of x then we can calculate the tokenURI of the NFT by using the following calculation

    • first, we will calculate the modNumber by using the following calculation modNumber = x % 10.

    • then we will use the modNumber to determine the tokenURI of the NFTs.

    • if modNumber is equal to 0 then the tokenURI of the NFT will be ART_ONE.

    • if modNumber is equal to 1 then the tokenURI of the NFT will be ART_TWO.

    • if modNumber is equal to 2 then the tokenURI of the NFT will be ART_THREE.

    • if modNumber is equal to 3 to 9 then the tokenURI of the NFT will be ART_FOUR.

  • For Example, if we have a tokenId of 10 then the tokenURI of the NFT will be ART_ONE because 10 % 10 = 0.

  • By the above calculation, we can easyly predict the tokenURI of the NFTs before minting them and also see that it is not random and not equal distributed.

Impact

  • Everyone can calculate the tokenURI of the NFTs by using the tokenId of the NFTs.

  • It is not random and can be predicted before minting the NFTs and TokenURI is not equal distributed.

Tools Used

  • Manual Review

Recommendations

  • Use chainlink VRF to generate random numbers and use them to determine the tokenURI of the NFTs.

  • Use Off-chain random number generation to determine the tokenURI of the NFTs.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

NFT's should have equal distribution

NFTs are not random

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.