Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Wrong ERC1155 metadata URI

y0ng0p3

Summary

Wrong ERC1155 metadata URI

Vulnerability Details

OWPIdentify and MembershipERC1155 implement the ERC1155 metadata extension. However they incorrectly set the URIs, as the ERC1155 specification says:

The URI MUST point to a JSON file that conforms to the "ERC-1155 Metadata URI JSON Schema".
File: contracts/dao/tokens/MembershipERC1155.sol#L117-L124
​
function uri(uint256 tokenId) public view virtual override returns (string memory) {
return string(abi.encodePacked(
super.uri(tokenId),
Strings.toHexString(uint256(uint160(address(this))), 20),
"/",
Strings.toString(tokenId)
));
}
File: contracts/OWPIdentity.sol#L27-L29
​
function uri(uint256 tokenId) public view virtual override returns (string memory) {
return string.concat(super.uri(tokenId), tokenId.toString());
}

Impact

Incorrect URIs will affect off-chain integrations with the tokens that will try to read tokens’ metadata and fail.

Tools Used

Manual review.

Recommendations

Consider correctly return the URIs in OWPIdentify and MembershipERC1155.

File: contracts/dao/tokens/MembershipERC1155.sol#L117-L124
​
function uri(uint256 tokenId) public view virtual override returns (string memory) {
return string(abi.encodePacked(
super.uri(tokenId),
Strings.toHexString(uint256(uint160(address(this))), 20),
"/",
-- Strings.toString(tokenId)
++ Strings.toString(tokenId),
++ ".json"
));
}
File: contracts/OWPIdentity.sol#L27-L29
​
function uri(uint256 tokenId) public view virtual override returns (string memory) {
-- return string.concat(super.uri(tokenId), tokenId.toString());
++ return string.concat(super.uri(tokenId), tokenId.toString(), ".json");
}

Alternatively, consider not implementing the metadata extension since it’s optional.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.