Beatland Festival

First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Impact: high
Likelihood: low
Invalid

`collectionId` too big will cause `tokenId` to overflow in `encodeTokenId`

collectionId too big will cause tokenId to overflow in encodeTokenId causing decodeTokenId to return unexpected results

Description

  • Users can redeem a memorabilia NFT from a collection after they burn their BEAT by attending a performance in redeemMemorabilia

  • When the collectionId becomes too big it will cause the tokenId returned to overflow and start from 0

  • When other functions like uri and getMemorabiliaDetails are being called they will return 0 for collectionId and itemId instead of the correct collectionId i.e. 340282366920938463463374607431768211456 passed in the first place

function encodeTokenId(uint256 collectionId, uint256 itemId) public pure returns (uint256) {
return (collectionId << COLLECTION_ID_SHIFT) + itemId;
//@audit if passing 2^127 i.e. 340282366920938463463374607431768211456 as collectionId, it will overflow and return 0
}

Risk

Likelihood:

  • When passing 2^127 i.e. 340282366920938463463374607431768211456 as collectionId the returned tokenId will be 0

Impact:

  • ERC1155 token with the same tokenId will be minted

  • Other functions like uri and getMemorabiliaDetails which involves calling decodeTokenId will return unexpected results

Proof of Concept

When we pass 2^127 as collectionId to encodeTokenId(uint256 collectionId, uint256 itemId) the tokenId will be returned as 0 which is a result from overflow, and this will cause incorrect assumption on the result of decodeTokenId(uint256 tokenId)

encodeTokenId(340282366920938463463374607431768211456, 0); // tokenId returned as 0
decodeTokenId(0); // return collectionId as 0, itemId as 0

Recommended Mitigation

  • Make sure the collectionId will never reach bigger than type(uint128).max + 1 or add a condition checking directly

Updates

Lead Judging Commences

inallhonesty Lead Judge
28 days ago
inallhonesty Lead Judge 26 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.