DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

tokenURI() Missing data: URI Scheme Prefix

rivera

Description

  • Normal behavior: tokenURI() should return a properly-formatted data URI that wallets/marketplaces can render directly.

  • Specific issue: _baseURI() is never overridden (defaults to OZ's empty string), so the returned Base64 payload has no data:application/json;base64, prefix.

return string(
abi.encodePacked(
_baseURI(), // @> never overridden, defaults to "" — resulting string has no data: URI scheme prefix
Base64.encode(...)
)
);

Risk

Likelihood: Occurs on every single tokenURI() call, no exception.
Impact: Display/UX only — likely won't render correctly in standard wallets/marketplaces expecting a proper data URI; no fund or access-control consequence.

Proof of Concept

No PoC is included: tokenURI() returns exactly what the code says it returns — a raw Base64 string with no scheme prefix — which is directly verifiable by reading the function's output for any minted token and comparing it against the ERC-721/ERC-4906 data: URI convention; there's no state-dependent behavior to reproduce beyond that.

Recommended Mitigation

Overriding _baseURI() to return the standard data:application/json;base64, prefix is the idiomatic OZ pattern for fully on-chain metadata (the base is prepended automatically by tokenURI()'s existing abi.encodePacked(_baseURI(), ...) call, so no other logic needs to change).

+ function _baseURI() internal pure override returns (string memory) {
+ return "data:application/json;base64,";
+ }
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 1 day ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!