Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Incorrect NFT Metadata Title in `WeatherNft::tokenURI`

okhayeelizabeth

Description

The WeatherNft::tokenURI defines the name field in the JSON metadata as Weathear NFT, which contains a typographical error, the name of the nft was given in the WeatherNft constructor as ERC721("Weather NFT", "W-NFT"). This typo could reduce perceived project quality or user trust when NFTs are displayed in marketplaces or wallets.

function tokenURI(uint256 tokenId) public view override returns (string memory) {
_requireOwned(tokenId);
string memory image = s_weatherToTokenURI[s_tokenIdToWeather[tokenId]];
​
bytes memory jsonData = abi.encodePacked(
// nft name has a typo...
@> '{"name": "Weathear NFT", "user": "',
Strings.toHexString(_ownerOf(tokenId)),
'", "image": "',
image, '"}'
);
​
string memory base64TransformedData = Base64.encode(jsonData);
return string.concat(_baseURI(), base64TransformedData);
}
​

Risk

Likelihood: High

  • The tokenURI() function is called automatically by external platforms to retrieve NFT metadata.

  • This metadata is visible to all users interacting with the NFT (via wallets, UIs, marketplaces), issue is deterministic and will consistently appear for every minted NFT.

Impact: Low

*The typo does not impact the core business logic, token economics, or minting flow.

*However, it does impair user-facing presentation and may reduce credibility.

Proof of Concept

When an NFT is queried via the tokenURI() function (e.g., through a wallet or marketplace), the metadata returned contains the following JSON string:

{
"name": "Weathear NFT",
"user": "0x...",
"image": "ipfs://..."
}

The name field shows "Weathear NFT" instead of the intended "Weather NFT", due to a hardcoded typo in the contract. This metadata string is base64-encoded and publicly accessible, meaning the error propagates to every interface or platform that reads the NFT's metadata.

Recommended Mitigation

Update the name value in tokenURI() metadata to correct the typo:

- '{"name": "Weathear NFT", "user": "',
+ '{"name": "Weather NFT", "user": "',
Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.