Namespace fuse ignores font class attribute from tile data

Lines of code Vulnerability details Impact The fuse function present in the Namespace contract mints a new Namespace NFT based on the given character data that references Tray tiles owned by the caller. For each character, the implementation will use the characterToUnicodeBytes function from the...

characterModifier is uint8 but encodes 1.38e24 different Zalgo distortions.

Lines of code Vulnerability details Impact Only 256 Zalgo distortions are possible, which is a miniscule fraction of the actual combinations possible. Proof of Concept A Zalgo tile is defined by a letter and a modification consisting of a combination of characters above, over and below the letter...

Namespace tokenName has only emojis.

Lines of code Vulnerability details Impact The tokenName and image of Namespace should always be the same. The image is correct but the tokenName only consists of emojis. Duplicate names are checked on the tokenName and not on the image. Because of this a tile of font class 1 with character index...

Incorrect argument passed to "Utils.characterToUnicodeBytes" in "Namespace.fuse"

Lines of code Vulnerability details Impact The function Namespace.fuse uses Utils.characterToUnicodeBytes to get the unicode bytevalue for a given Tile. The first argument of characterToUnicodeBytes is an uint8 value representing the font class. Instead of passing the font class in the tile data,...