Summary:

The tokenURI function constructs JSON metadata by directly concatenating user input (name, profileImage). This introduces a JSON injection vulnerability, allowing an attacker to manipulate the metadata by injecting special characters like double quotes (") or backslashes (\). Exploiting this, an attacker can alter NFT metadata, insert fake attributes, or disrupt NFT marketplaces relying on the token URI.

Vulnerability Details:

• The function builds JSON using abi.encodePacked, inserting unescaped user input.

• If an attacker supplies a malicious name or profileImage, they can break the JSON structure, inject arbitrary data, or modify metadata behavior.

• JSON consumers (e.g., NFT marketplaces, wallets) will misinterpret the metadata, leading to incorrect attribute displays or spoofed profiles.

Code Snippet (Vulnerable Code):

🚨 Risk: No escaping mechanism is applied, making it possible to inject unintended JSON elements.

Impact:

1. Metadata Tampering: Attackers can inject fake attributes, misleading users and NFT platforms.

2. Broken NFT Listings: Malformed JSON may cause token metadata to fail to load on marketplaces.

3. Security Risks in External Platforms: Marketplaces parsing the JSON might be vulnerable to further exploits.

4. Loss of Trust: Users may not trust metadata if attackers can spoof names or attributes.

Proof of Concept (PoC):

Attack Scenario – Injecting Fake Metadata Attributes

1. Malicious User Calls mintProfile with Injected JSON Characters

   mintProfile('Evil"Profile", "attributes": [{"trait_type": "Age", "value": 100}], "image":"evil.com" } //', 25, "ipfs://malicious_image");

2. Generated JSON (Incorrectly Parsed by Marketplaces)

   {

   "name": "Evil"Profile",

   "attributes": [{"trait_type": "Age", "value": 100}],

   "image":"evil.com" } //"

   }

   Effect:

   • The name field breaks the JSON format.

   • The attacker inserts fake attributes (Age = 100 instead of 25).

   • The remaining metadata could be ignored or misinterpreted.

Reference:

Recommended Mitigation:

✅ Escape User Input Before Concatenating into JSON

Implement a JSON escaping function to properly encode special characters (", \, etc.):

✅ Apply Fix: Use Struct-Based Encoding

Instead of manual string concatenation, use abi.encode for structured JSON objects: