## [HM-2] `TokenUri`'s 51 KB constant is inlined into `SantasList`, putting runtime code 2.48× over EIP-170 — the contract cannot be deployed

### Description

- `TokenUri` exists to hold the token metadata, and `SantasList` inherits it so `tokenURI()` can

return the blob. The specification calls it *"a separate contract inherited by `SantasList` for

readability purposes."*

- A `string public constant` is inlined verbatim into the runtime bytecode of every contract that

inherits it. The constant is 51,613 bytes, which puts `SantasList` at **61,030 bytes against the

24,576-byte EIP-170 cap** and its initcode at **70,811 against EIP-3860's 49,152**. The `CREATE`

returns oversized code and the deployment transaction reverts. Arbitrum One enforces EIP-170.

```solidity

// src/TokenUri.sol:9-11

contract TokenUri {

@> string public constant TOKEN_URI =

"data:application/json;base64,ewogICAgIm5hbWUiOiAi..."; // 51,613 bytes

// src/SantasList.sol:59

@> contract SantasList is ERC721, TokenUri { // inlines all 51,613 bytes

```

### Risk

**Likelihood:** High — this is a property of the audited commit, not a probability.

- `forge build --sizes` exits non-zero at the audited commit.

- Foundry raises the code-size limit for test deployments, so the shipped test suite passes against a

contract that cannot exist on-chain, and the repository's CI workflow is `on: workflow_dispatch`

only, so it never runs on push or pull request.

**Impact:**

- The protocol has no on-chain existence. Runtime overshoot is 36,454 bytes; `TokenUri` alone is

51,714 bytes and is over both caps by itself.

- No funds are at risk, because no funds can ever be deposited — which is why the impact is rated

Medium rather than High despite the disruption being total.

• **This does not undercut the other findings.** `test/Claude/F06_IndependenceCheck.t.sol` deploys a

SantasList carrying **only** this mitigation at 8,998 bytes and demonstrates H-1, H-2, H-3, H-4,

HM-1 and M-1 all still working on it. Seven defects, seven disjoint fixes.

### Proof of Concept

```solidity

function test_F06_deployFailsUnderRealEip170() public {

// deployCode loads the artifact at runtime; `new SantasList()` would inline the

// 70,811-byte creation code into the TEST contract and make the suite undeployable.

try this.deploy() returns (address deployed) {

fail();

} catch {

// CREATE reverted: EvmError CreateContractSizeLimit

}

}

function deploy() external returns (address) { return deployCode("SantasList.sol:SantasList"); }

```

### Recommended Mitigation

```diff

- contract SantasList is ERC721, TokenUri {

+ contract SantasList is ERC721 {

function tokenURI(uint256) public pure override returns (string memory) {

- return TOKEN_URI;

+ return "ipfs://<metadata-cid>";

}

```

Alternatively keep `TokenUri` as a separately deployed contract that `SantasList` calls — note it is

over both caps on its own, so it must also be split or moved off-chain — or store the blob with

SSTORE2 and read it at runtime. Add `forge build --sizes` to CI, which currently triggers only on `workflow_dispatch`.