DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Unvalidated Metadata Inputs in `SoulboundProfileNFT::tokenURI()` function

mishraji874

Description: No sanitization of user-provided metadata fields

Impact: Potential metadata manipulation

Proof of Concept:

function injectMaliciousMetadata() external {
// Inject malicious JSON or script in metadata
soulboundNFT.mintProfile(
'{"name":"Hacker", "malicious":"<script>alert(\'XSS\')</script>"}',
25,
"javascript:alert('Injected')"
);
}

Recommended Mitigation:

  • Implement input validation

  • Sanitize string inputs

  • Limit metadata field lengths

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_URI_injection_scam_underaged_bad_name_photo_etc

Scamming/phishing is not the protocol problem, that's a user mistake. NFT are unique, even if someone does a copy of your profile (which is also possible in web2), I consider it informational. Injection is a problem for the web2 part of the protocol, not a bug here. For the age, it depends on the countries law and future medicine. Anyways, that's more an ethical/political problem, not a bug.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.