Profile Picture: Address Registry should maintain storage between consecutive deploys

Lines of code Vulnerability details H-01 Profile Picture: Address Registry should maintain storage between consecutive deploys This vulnerability is more in the code of Canto Identity Protocol, but it impacts the ProfilePicture Subprotocol. A ProfilePicture NFT with id=pfpId is linked to a CID NF...

Adding NFTS with AssociationType ORDERED or PRIMARY may cause overwriting

Risk rating Medium Risk Links to affected code Impact Subprotocol NFTs may be trapped in contract CidNFT forever. Proof of Concept When adding NFT to CidNFT with AssociationType ORDERED or PRIMARY, the cidData is written directly, without checking and handling the case that a previously added nft...

The users can't add traits for their CidNFT's

Lines of code Vulnerability details Proof of Concept The CidNFT contract implements the add function for the users to add traits/subprotocol Id's to their CidNFT's. During calling add function, it validates whether the user is the owner of the provided CiDNFT and the user is approved by the owner...

Other users cannot help a CIDNFT holder add subprotocols to the NFT

Lines of code Vulnerability details Impact Other users cannot approve and help CIDNFT holders add subprotocols to the NFT, breaking protocol specifications. Proof of Concept In the video walkthrough, around the 8 minute mark, it is mentioned that users can help NFT holders add subprotocols to the...

CidNFT: Broken tokenURI function

Lines of code Vulnerability details CidNFTtokenURI does not convert the uint256 id argument to a string before interpolating it in the token URI: /// @notice Get the token URI for the provided ID /// @param id ID to retrieve the URI for /// @return tokenURI The URI of the queried token path to a...

CidNFT#add will break if _type is not passed in correctly

Lines of code Vulnerability details Impact CIDNFT holders that wants to add subprotocols to their NFT will not be able to anymore because the subprotocol NFT will be stuck in the CidNFT.sol contract. Proof of Concept When a CIDNFT holder wants to add subprotocols to their NFT, he will call...

Griefing risk in mint

Lines of code Vulnerability details Impact CidNFT.mint has an optional parameter addList that enables users to register subprotocol NFTs to the CID NFT right after the mint. However, there is no guarantee that the cidNFTID encoded in addList is the same ID as the newly minted NFT. If there is a...

cidFeeWallet can be address(0)

Lines of code Vulnerability details Impact TLDR; the cidFeeWallet can be assigned to address0, in which case fees would be burned but otherwise the system operates as expected. In the constructor for both SubprotocolRegistry and CidNFT, a wallet is assigned to which fees will be sent. This applie...