DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

XSS Vulnerability in SoulboundProfileNFT.sol::tokenURI() Function

0xalipede

Summary

The SoulboundProfileNFT.sol::tokenURI() function constructs metadata using user-provided inputs (name, age and image URL) without sanitization. This creates a risk of a Cross-Site Scripting (XSS) attack if a malicious user mints an NFT with JavaScript payloads embedded in the metadata fields. When displayed in a browser-based NFT viewer, the malicious script could execute, leading to potential theft of session data, cookies, or even user keys.

Vulnerability Details

The SoulboundProfileNFT.sol::tokenURI() function directly incorporates user-controlled inputs (name and profileImage) into the returned JSON metadata. If a malicious user inputs a script payload, it could execute in environments that do not properly sanitize or escape metadata before rendering.

Affected code:

function tokenURI(uint256 tokenId) public view virtual override returns (string memory) {
if (ownerOf(tokenId) == address(0)) {
revert ERC721Metadata__URI_QueryFor_NonExistentToken();
}
string memory profileName = _profiles[tokenId].name;
uint256 profileAge = _profiles[tokenId].age;
string memory imageURI = _profiles[tokenId].profileImage;
​
// No sanitization when building the NFT metadata
return string(
abi.encodePacked(
_baseURI(),
Base64.encode(
bytes(
abi.encodePacked(
'{"name":"',
profileName,
'", ',
'"description":"A soulbound dating profile NFT.", ',
'"attributes": [{"trait_type": "Age", "value": ',
Strings.toString(profileAge),
'}], ',
'"image":"',
imageURI,
'"}'
)
)
)
)
);
}

Impact

  • A malicious user can inject JavaScript in the name or profileImage fields, leading to an XSS attack when the NFT metadata is displayed in a vulnerable frontend.

  • The attack can compromise user wallets, session data, or other sensitive information.

  • Affected platforms may be exploited to distribute malicious payloads.

Tools Used

  • Manual review

Recommendations

I would recommend the following:

  • Escape or sanitize user inputs before including them in metadata.

  • Implement validation to restrict name and profileImage to alphanumeric characters and valid URLs.

  • Use proper encoding (e.g., HTML entity encoding) before rendering the metadata in a frontend.

  • Consider using a trusted metadata storage solution instead of directly embedding user inputs.

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_URI_injection_scam_underaged_bad_name_photo_etc

Scamming/phishing is not the protocol problem, that's a user mistake. NFT are unique, even if someone does a copy of your profile (which is also possible in web2), I consider it informational. Injection is a problem for the web2 part of the protocol, not a bug here. For the age, it depends on the countries law and future medicine. Anyways, that's more an ethical/political problem, not a bug.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.