Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing event emission in `MembershipERC1155::setURI` is incompliant with EIP-1155

x18a6

Summary

Missing event emission in MembershipERC1155::setURI is incompliant with EIP-1155

Vulnerability Details

EIPS/eip-1155#metadata:

The optional ERC1155Metadata_URI extension can be identified with the ERC-165 Standard Interface Detection.

This is the case in our code as could be seen in the MembershipERC1155::supportsInterface function:

contracts/dao/tokens/MembershipERC1155.sol#L132-L140

/**
* @dev See {IERC165-supportsInterface}.
*/
function supportsInterface(bytes4 interfaceId) public view virtual override(ERC165Upgradeable, IERC165) returns (bool) {
return
interfaceId == type(IERC1155).interfaceId ||
interfaceId == type(IERC1155MetadataURI).interfaceId ||
super.supportsInterface(interfaceId);
}

The EIPS/eip-1155#metadata proceed to state:

If the optional ERC1155Metadata_URI extension is included:
The ERC-165 supportsInterface function MUST return the constant value true if 0x0e89341c is passed through the interfaceID argument.
Changes to the URI MUST emit the URI event if the change can be expressed with an event (i.e. it isn’t dynamic/programmatic).

However, the MembershipERC1155::setURI function does not emit such URI event:

contracts/dao/tokens/MembershipERC1155.sol#L105-L109

/// @notice Set a new URI for all token types
/// @param newURI The new URI to set
function setURI(string memory newURI) external onlyRole(DAO_CREATOR) {
_setURI(newURI);
}

It worth noting that ERC1155Upgradeable::_setURI states that it doesn't emit any such event, so it's on the contract developer to emit it:

contracts/token/ERC1155/ERC1155Upgradeable.sol#L301-L302

/**
* @dev Sets a new URI for all token types, by relying on the token type ID
* substitution mechanism
* https://eips.ethereum.org/EIPS/eip-1155#metadata[defined in the ERC].
*
...
* Because these URIs cannot be meaningfully represented by the {URI} event,
* this function emits no events.
*/
function _setURI(string memory newuri) internal virtual {
ERC1155Storage storage $ = _getERC1155Storage();
$._uri = newuri;
}

Impact

Incompliance with EIP-1155.

Tools Used

EIP-1155.

Recommendations

Emit the URI event.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

x18a6 Submitter
about 1 year ago
0xbrivan2 Lead Judge
about 1 year ago
0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.