Eggstravaganza

Summary

The smart contracts in the project use the SPDX license identifier // SPDX-License-Identifier: SEE LICENSE IN LICENSE, but there is no LICENSE file present in the project repository. This creates legal uncertainty regarding code usage, could violate open-source license requirements, and may prevent proper contract verification.

Vulnerability Details

OpenZeppelin contracts typically use the MIT license (// SPDX-License-Identifier: MIT), as seen in the imported ERC721.sol file. However, the project's custom contracts reference a non-existent license file:

This indicates that the license terms should be found in a file named LICENSE in the project repository, but no such file exists. This creates several issues:

1. Legal ambiguity regarding the terms under which the code can be used, modified, or distributed

2. Potential violation of the terms of imported libraries (like OpenZeppelin) which require attribution

3. Potential non-compliance with blockchain explorers' verification requirements, which often validate SPDX identifiers

The SPDX (Software Package Data Exchange) license identifiers are standard elements in Solidity code that help with automated license checking and compliance. Using an invalid or unresolvable identifier defeats this purpose.

Impact

The impact of this vulnerability includes:

1. Legal Uncertainty: Users, auditors, and contributors have no clear understanding of the legal terms governing the code

2. Verification Issues: Contract verification services may reject the contracts due to the invalid license reference

3. Potential License Violations: If the project incorporates licensed code (like OpenZeppelin), failing to properly specify the license could constitute a violation of those licenses

4. Deployment Complications: Some deployment pipelines include license validation steps that would fail

While this may not directly lead to fund loss, it creates significant legal and operational risks for the project and its users.

Tools Used

• Manual code review

Recommendations

1. Create a proper LICENSE file in the project root directory that specifies the intended license terms, ensuring compliance with any incorporated open-source code.

   or

2. Replace the SPDX identifier in all contract files with a standard, valid identifier like:

   ```solidity

   // SPDX-License-Identifier: MIT