60,000 USDC
Submission Details
Severity:
Cairo bridge does not support ERC721 if it does not use the snake case token_uri function
During token_uri_from_contract_call inside theerc721metadata function, a panic will be encountered because call_contract_syscall will panic rather than throw an error that can be caught if the token_uri doesn't exist on the collection be called - https://github.com/OpenZeppelin/cairo-contracts/issues/904
match starknet::call_contract_syscall(
collection_address,
token_uri_selector,
calldata,
) {
Result::Ok(span) => span.try_into(),
Result::Err(_e) => {
match starknet::call_contract_syscall(
collection_address, tokenURI_selector, calldata,
) {
Result::Ok(span) => span.try_into(),
Result::Err(_e) => {
Option::None
}
}
}
}
Essentially the 2nd check for the camel case tokenURI function will never be reached.
Updates
Lead Judging Commences
n0kto 12 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
invalid-call_contract_syscall-panic-in-StarknetOS
Audit report [L-01]
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.