QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

The contract inherits from ERC721 but doesn't implement the required tokenURI function

kwakudr

Summary

The ERC721 metadata extension which is part of the OpenZeppelin implementation requires a tokenURI function. This function should return a URI pointing to the token's metadata in JSON format. The metadata typically includes properties like name, description, and image.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/LPNFT.sol#L15C1-L35C6

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/LPNFT.sol#L15C1-L35C6

contract LPNFT is ERC721 {

uint256 numMinted;
​
​
/// @notice the address of the QuantAMM router this token is for
UpliftOnlyExample public router;
​
​
/// @notice Modifier for only allowing the router to call certain functions
modifier onlyUpliftOnlyRouter() {
require(msg.sender == address(router), "ROUTERONLY");
_;
}
​
​
​
​
constructor(
string memory _name,
string memory _symbol,
address _router
) ERC721(_name, _symbol) {
router = UpliftOnlyExample(payable(_router));
}

The ERC721 metadata extension which is part of the OpenZeppelin implementation requires a tokenURI function. This function should return a URI pointing to the token's metadata in JSON format. The metadata typically includes properties like name, description, and image.

As can be seen in the code, there is no tokenURI. Without tokenURI, applications and marketplaces can't fetch metadata about the NFTs

  • This breaks interoperability with NFT platforms, wallets, and other services

  • Users won't be able to see proper NFT representations in their wallets

  • The contract will not be fully ERC721 compliant

Impact

Without tokenURI, applications and marketplaces can't fetch metadata about the NFTs

Tools Used

Manual Review

Recommendations

implement a tokenURI.

The metadata could include important information about the liquidity position . For example: pool address, token amounts, fee tier, price range. This makes the NFT more useful as it can display relevant information to LP providers

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_LPNFT_no_tokenURI

ERC721 Metadata extension is optional in the standard.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!