NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

`metadataFrozen` variable declared but never enforced allowing owner to change collection image at any time

Author Revealed upon completion

`metadataFrozen` variable declared but never enforced allowing owner to change collection image at any time

Description

`NFTDealers` declares a `metadataFrozen` boolean that implies metadata immutability functionality, but no function ever reads or sets this variable. The `collectionImage` used in `_baseURI()` can be changed freely by the owner at any time, creating a potential rug vector where the owner could swap collection artwork after mint.

bool public metadataFrozen; // @> declared but never used

Risk

-

Proof of Concept

-

Recommended Mitigation

if contract developer design the contract by adding metadatFrozen that is not implemented yet, consider to remove that variable, but if that variable intended to be implemented consider Implement `metadataFrozen` enforcement with a freeze function:

+function freezeMetadata() external onlyOwner {
+ metadataFrozen = true;
+}
​
+function setCollectionImage(string memory _newImage) external onlyOwner {
+ require(!metadataFrozen, "Metadata is frozen");
+ collectionImage = _newImage;
+}
​

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!