collectionId
too big will cause tokenId
to overflow in encodeTokenId
causing decodeTokenId
to return unexpected resultsUsers can redeem a memorabilia NFT from a collection after they burn their BEAT by attending a performance in redeemMemorabilia
When the collectionId
becomes too big it will cause the tokenId
returned to overflow and start from 0
When other functions like uri
and getMemorabiliaDetails
are being called they will return 0
for collectionId
and itemId
instead of the correct collectionId
i.e. 340282366920938463463374607431768211456
passed in the first place
Likelihood:
When passing 2^127
i.e. 340282366920938463463374607431768211456
as collectionId
the returned tokenId
will be 0
Impact:
ERC1155 token with the same tokenId will be minted
Other functions like uri
and getMemorabiliaDetails
which involves calling decodeTokenId
will return unexpected results
When we pass 2^127 as collectionId
to encodeTokenId(uint256 collectionId, uint256 itemId)
the tokenId
will be returned as 0 which is a result from overflow, and this will cause incorrect assumption on the result of decodeTokenId(uint256 tokenId)
Make sure the collectionId
will never reach bigger than type(uint128).max + 1
or add a condition checking directly
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.