Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

The owner can change the baseURI to one that is not IPFS

golomp3761

Summary

The RAACNFT.sol contract allows the owner to change baseURI to a non-decentralized domain, posing risks like DNS hijacking or domain expiration. To ensure NFT security and permanence, it's recommended to enforce IPFS or Arweave as the only valid storage options.

Vulnerability Details

In the RAACNFT.sol contract, the owner has the ability to change the baseURI value using the setBaseUri function to something other than decentralized IPFS, such as the domain test.xyz. This introduces additional risks, including:

  • Domain takeover attacks (DNS hijacking) – If the domain is compromised, an attacker could replace the linked NFT assets.

  • Domain expiration – If the domain expires, users may lose access to their NFTs, or the content could be redirected to unauthorized sources.

Impact

  • If the domain expires or is lost, NFT image becomes inaccessible.

  • If the domain is compromised through DNS hijacking, all NFT image could be maliciously altered.

Tools Used

Manual Review

Recommendations

It is recommended to restrict the ability to modify baseURI or enforce the use of only decentralized solutions like IPFS to ensure the permanence and security of NFT assets.

function setBaseURI(string memory _newBaseURI) public onlyOwner {
require(_isIPFS(_newBaseURI), "New baseURI must be an IPFS link");
baseURI = _newBaseURI;
emit BaseURIChanged(_newBaseURI);
}
​
function _isIPFS(string memory uri) internal pure returns (bool) {
bytes memory uriBytes = bytes(uri);
bytes memory prefix = bytes("ipfs://");
if (uriBytes.length < prefix.length) {
return false;
}
for (uint256 i = 0; i < prefix.length; i++) {
if (uriBytes[i] != prefix[i]) {
return false;
}
}
return true;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.