Canto Identity Subprotocols contest - Parad0x's results

Subprotocols for Canto Identity Protocol.

General Information

Platform: Code4rena

Start Date: 17/03/2023

Pot Size: $36,500 USDC

Total HM: 10

Participants: 98

Period: 3 days

Judge: leastwood

Total Solo HM: 5

Id: 223

League: ETH

Canto Identity Subprotocols

Findings Distribution

Researcher Performance

Rank: 80/98

Findings: 1

Award: $19.87

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

Awards

19.8705 USDC - $19.87

Labels

bug
2 (Med Risk)
satisfactory
duplicate-212

External Links

Lines of code

https://github.com/code-423n4/2023-03-canto-identity/blob/077372297fc419ea7688ab62cc3fd4e8f4e24e66/canto-bio-protocol/src/Bio.sol#L103-L115

Vulnerability details

Impact

Non-escaping special character may lead to invalid JSON format.

Proof of Concept

The Bio.sol code allows users to input a bio string and then generate a corresponding JSON format using the tokenURI() function for use in the front-end. However, caution should be exercised while concatenating the JSON as the bioText variable does not escape special characters such as ". This oversight could result in invalid JSON formatting.

Tools Used

Manual review.

Use a library to escape those characters such as LibString ( Solady for example ).

#0 - c4-judge

2023-03-28T00:43:12Z

0xleastwood marked the issue as duplicate of #212

#1 - c4-judge

2023-03-28T00:43:16Z

0xleastwood marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter