collectionId too big will cause tokenId to overflow in encodeTokenId causing decodeTokenId to return unexpected resultsUsers can redeem a memorabilia NFT from a collection after they burn their BEAT by attending a performance in redeemMemorabilia
When the collectionId becomes too big it will cause the tokenId returned to overflow and start from 0
When other functions like uri and getMemorabiliaDetails are being called they will return 0 for collectionId and itemId instead of the correct collectionId i.e. 340282366920938463463374607431768211456 passed in the first place
Likelihood:
When passing 2^127 i.e. 340282366920938463463374607431768211456 as collectionId the returned tokenId will be 0
Impact:
ERC1155 token with the same tokenId will be minted
Other functions like uri and getMemorabiliaDetails which involves calling decodeTokenId will return unexpected results
When we pass 2^127 as collectionId to encodeTokenId(uint256 collectionId, uint256 itemId) the tokenId will be returned as 0 which is a result from overflow, and this will cause incorrect assumption on the result of decodeTokenId(uint256 tokenId)
Make sure the collectionId will never reach bigger than type(uint128).max + 1 or add a condition checking directly
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.