Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing tokenURI implementation in NFT contract

0xshield

Description:
The EggstravaganzaNFT contract doesn't implement the tokenURI function:

constructor(string memory _name, string memory _symbol)
ERC721(_name, _symbol) Ownable(msg.sender)
{}

Impact:

  • NFTs won't display properly in marketplaces/wallets

  • No metadata (images, attributes) for tokens

  • Potential marketplace rejection

  • Poor user experience

Proof of Concept:

  1. User mints an NFT through the game

  2. Tries to view it in OpenSea or wallet

  3. NFT appears as broken/invalid

  4. No image or attributes displayed

  5. Marketplace may reject collection

Recommended Mitigation:
Implement one of:

  1. Fixed base URI + token ID suffix

function tokenURI(uint256 tokenId) public view override returns (string memory) {
return string(abi.encodePacked(baseURI, Strings.toString(tokenId)));
}

  1. Dynamic URI generation

  2. Separate metadata contract

Also consider:

  • IPFS hosting for decentralized metadata

  • Proper JSON metadata schema

  • Immutable metadata for provenance

Likelihood and Impact

  • Impact: Medium (functionality)

  • Likelihood: High

  • Severity: Medium

Updates

Lead Judging Commences

m3dython Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing Token URI

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!