Submission Details
Impact:
Likelihood:
Typo in deployed contract `NFT` naming, visible in JSON blob data
Root + Impact
Description
-
Typo in src file WeatherNft.sol
-
"Weathear NFT"→"Weather NFT"in functiontokenURI
function tokenURI(
uint256 tokenId
) public view override returns (string memory) {
_requireOwned(tokenId);
string memory image = s_weatherToTokenURI[s_tokenIdToWeather[tokenId]];
bytes memory jsonData = abi.encodePacked(
'{"name": "Weathear NFT", "user": "',
Strings.toHexString(_ownerOf(tokenId)),
'", "image": "',
image,
'"}'
);
string memory base64TransformedData = Base64.encode(jsonData);
return string.concat(_baseURI(), base64TransformedData);
}
Risk
Likelihood:
Low: would make a good observation to fix the ambigous name
Impact:
Ambiguity in NFT naming → Weather NFT
Proof of Concept
// Fix the errata -
// See #recommended-mitigation
Recommended Mitigation
- '{"name": "Weathear NFT", "user": "',
+ '{"name": "Weather NFT", "user": "',
Rewards breakdown
nSLOC
236This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.