Submission Details
Impact:
Likelihood:
Unsafe Bit-Packing in encodeTokenId Allows Silent Overflow
Root + Impact
Description
When shifting collectionId left by 128 bits, the function assumes both values fit within 128 bits each. Using
uint256 parameters is misleading and dangerous.
// Helper functions to encode/decode token IDs
function encodeTokenId(uint256 collectionId, uint256 itemId) public pure returns (uint256) {
return (collectionId << COLLECTION_ID_SHIFT) + itemId;
}
Risk
-
If
collectionId > type(uint128).max, the left shift will overflow and lose data -
If
itemId > type(uint128).max, it will corrupt the encodedcollectionIdportion -
No validation that inputs fit within their allocated bit ranges
Recommended Mitigation
Use safe casting both collectionId and itemId to uint128.
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.