Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Snowman Implements an Insecure URI Encoding

troglodytsec

Root + Impact

The tokenURI() function constructs JSON metadata without proper string sanitization and encoding steps, which could lead to:

  • Malformed URIs if imageURI or other dynamic values contain special characters (quotes, newlines, unicode)

  • JSON injection vulnerabilities if any input contains unescaped double quotes

  • Metadata corruption due to improper handling of UTF-8 multi-byte sequences

  • Potential Base64 encoding errors from raw packed bytes

Description

Key Issues

  • Dynamic inputs (name(), imageURI) are packed without UTF-8 validation

  • No escaping of quotes in dynamic values that could break JSON structure

  • Packed bytes may contain irregular sequences that Base64.encode() doesn't handle optimally

return string(
abi.encodePacked(
_baseURI(),
Base64.encode(
abi.encodePacked( // Unsanitized direct packing
'{"name":"',
name(),
'", "description":"Snowman for everyone!!!", ',
'"attributes": [{"trait_type": "freezing", "value": 100}], "image":"',
imageURI,
'"}'
)
)
)
);

Risk

Likelihood: MEDIUM-LOW

  • The problem can arise intentionally or not; it depends on the image URI provided.

Impact: HIGH

  • All NFT's will be broken;

  • The problem can be uncovered later after snow distribution.

Proof of Concept

​

Recommended Mitigation

Implement proper encoding flow with intermediate string conversion:

return string(
abi.encodePacked(
_baseURI(),
Base64.encode(
+ bytes(string( // Convert to string and back for sanitization
abi.encodePacked(
'{"name":"',
name(),
'", "description":"Snowman for everyone!!!", ',
'"attributes": [{"trait_type": "freezing", "value": 100}], "image":"',
imageURI,
'"}'
)
))
)
)
);
Updates

Lead Judging Commences

yeahchibyke Lead Judge 10 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.