Canto Identity Subprotocols contest - Englave's results

Lines of code

https://github.com/code-423n4/2023-03-canto-identity/blob/main/canto-bio-protocol/src/Bio.sol#L98

Vulnerability details

Impact

The current implementation of the tokenURI function generates an SVG with a viewBox height of 100, which might only be enough to display up to 2 lines of text. However, the bio text can be up to 5 lines in length. This may result in the text being cut off or displayed incorrectly. Additionally, the logic for generating the SVG and splitting lines is quite heavy for on-chain execution, and it might be more efficient to move this functionality off-chain, only storing the bio data on the blockchain.

Furthermore, the current implementation does not sanitize the user-provided bio text, which could allow an attacker to inject malicious code, such as hyperlinks or extra line breaks, inside the <tspan> element. This could lead to unintended behavior or security vulnerabilities.

Proof of Concept

Add <br> tags into bio text to break the layout. Add hyperlinks, or other attributes to make text custom

Tools Used

Visual inspection

Recommended Mitigation Steps

To address these issues:

1. Adjust the SVG viewBox dimensions to ensure that the content fits correctly, considering the possibility of displaying up to 5 lines of text.

2. Consider moving the SVG generation and line-splitting logic off-chain, storing only the bio data on the blockchain, to reduce the computational load and gas costs associated with on-chain execution.

3. Sanitize the user-provided bio text to prevent the injection of malicious code, such as hyperlinks or extra line breaks. Implement input validation and escape any potentially dangerous characters before incorporating the bio text into the SVG.