NFTs originally from L2 will have no tokenURI on L1
Summary
NFTs originally from L2 will have no tokenURI on L1.
Vulnerability Details
In Bridge.sol at no point does it update the URI for collections originating from L1
Impact
Users will be unable to see the image for their NFT.
Tools Used
Manual Review
Recommendations
The baseURI and tokenURI is already sent from the l2 so for most collections all that is needed is to update the baseURI on l1 if it is empty.
There is a potential danger with the token being unable to be transfered back if the URI is to big.
Lead Judging Commences
invalid-NFT-minted-without-baseURI-URIs-or-bridge-with-no-metadata
URI is not lost on the origin chain and it can be modified with `ERC721UriImpl`. As explained in the TODO below, that’s a design choice and it will be implemented as a future feature. https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/Bridge.sol#L206 `ERC721Bridgable` is out of scope.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.