Submission Details
Severity:
Inadequate Token URI Security
Description: The token URI generation includes sensitive data (donor address and amount) without encryption or privacy controls.
function _createTokenURI(address donor, uint256 date, uint256 amount) internal pure returns (string memory)
Impact:
Donor privacy concerns
Public visibility of donation amounts
Possible donor targeting
Recommended Mitigation: Implement optional privacy controls:
struct DonationMetadata {
address donor;
uint256 date;
uint256 amount;
bool isPrivate;
}
mapping(uint256 => DonationMetadata) private donationMetadata;
function _createTokenURI(uint256 tokenId) internal view returns (string memory) {
DonationMetadata memory metadata = donationMetadata[tokenId];
if (metadata.isPrivate) {
return _createPrivateURI(tokenId);
}
return _createPublicURI(metadata);
}
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.