Description

• Normal Behavior:
  The getUserMemorabiliaDetailed(address user) function is a public view function that returns full arrays of all memorabilia token details owned by a user, including:

  • tokenIds

  • collectionIds

  • itemIds

  It likely iterates over the user's ERC1155 balance or internal mappings to compile this information.

  
  

• Specific Issue:
  This type of function does not scale as the number of tokens a user holds increases. Ethereum has a block gas limit, and returning large dynamic arrays can cause out-of-gas errors on-chain or make frontend integrations unreliable.

Risk

Likelihood:

• As user adoption grows, collectors may own hundreds or thousands of memorabilia NFTs.

• Once user balances become large, this function may revert due to gas exhaustion, especially if called from another contract or in batch queries.

Impact:

• Denial-of-Service: Frontends depending on this function will break or fail to load memorabilia data.

• Limits usability for power users and collectors.

• Breaks indexers or integrators trying to query metadata on-chain

Proof of Concept

Recommended Mitigation