Submission Details
Impact:
Likelihood:
[H-2] The ```WeatherNft:::tokenURI``` Function Has Missing Access Control.
Root + Impact
The WeatherNft:::tokenURI Function Has Missing Access Control.
Description
The ```WeatherNft:::tokenURI``` Function Has Missing Access Control.The ```WeatherNft:::tokenURI``` should
Only Be Called By The Onwer Of That Token(NFT).Anyone Can Call ```tokenURI``` Function And can retrieve the
Important Metadata And Sensitive information.Additionally,
the _requireOwned function is referenced in the code but is not implemented, resulting in a compilation error
and leaving the intended access control unimplemented.
```javacript
Undeclared identifier.
--> src/WeatherNft.sol:293:9:
|
293 | _requireOwned(tokenId);
| ^^^^^^^^^^^^^
```
Risk
Impact:
Due To Undeclared access control ,Any malicious user/attacker can call the tokenURI function and retreive the Data.
Important metadata gets leaked.
Proof of Concept
Attack Scenario:
Bob mints SUNNY nft with Tokenid(1).
Alice mints Rainy nft with Token(2).
An attacker calls the tokenURI function with tokenId = 1 (Bob's token) and retrieves its metadata without being the owner.
Recommended Mitigation
- _requireOwned(tokenId);
```
If Protocol is Meant To Check ownership Then Use This From ERC721.
/**
* @dev See {IERC721-ownerOf}.
*/
function ownerOf(uint256 tokenId) public view virtual override returns (address) {
address owner = _ownerOf(tokenId);
require(owner != address(0), "ERC721: invalid token ID");
return owner;
}
+ +require(ownerOf(tokenId) == msg.sender, "caller is not owner");
Full Code:
function tokenURI(
uint256 tokenId
) public view override returns (string memory) {
require(ownerOf(tokenId) == msg.sender, "caller is not owner");
string memory image = s_weatherToTokenURI[s_tokenIdToWeather[tokenId]];
bytes memory jsonData = abi.encodePacked(
'{"name": "Weathear NFT", "user": "',
Strings.toHexString(_ownerOf(tokenId)),
'", "image": "',
image,
'"}'
);
string memory base64TransformedData = Base64.encode(jsonData);
return string.concat(_baseURI(), base64TransformedData);
}
Rewards breakdown
nSLOC
236This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.