Canto Identity Subprotocols contest - rokso's results

Lines of code

https://github.com/code-423n4/2023-03-canto-identity/blob/main/canto-bio-protocol/src/Bio.sol#L121-L128

Vulnerability details

Impact

In Bio.sol, users can mint bio up to 200 characters and when user call tokenURI() then SVG will be generated using bio. There is no validation of contents of bio string at the time of mint() and this will results in generating invalid SVG if bio string has opening angle bracket (<) in it. For example, "This is invalid bio.< Angle bracket will break SVG".

Proof of Concept

Mint()=>Bio.sol#L121 Below test is minting a bio which has < in bio string.

    function testInvalidSVGInTokenURI() public {
        string
            memory text = unicode"This is invalid bio.< Angle bracket will break SVG";
        bio.mint(text);
        uint256 tokenId = bio.numMinted();
        string memory uri = bio.tokenURI(tokenId);
        console.log("tokenURI is", uri);
    }

Below is tokenURI of such bio, data:application/json;base64,eyJuYW1lIjogIkJpbyAjMSIsICJkZXNjcmlwdGlvbiI6ICJUaGlzIGlzIGludmFsaWQgYmlvLjwgQW5nbGUgYnJhY2tldCB3aWxsIGJyZWFrIFNWRy4iLCAiaW1hZ2UiOiAiZGF0YTppbWFnZS9zdmcreG1sO2Jhc2U2NCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhCeVpYTmxjblpsUVhOd1pXTjBVbUYwYVc4OUluaE5hVzVaVFdsdUlHMWxaWFFpSUhacFpYZENiM2c5SWpBZ01DQTBNREFnTVRBd0lqNDhjM1I1YkdVK2RHVjRkQ0I3SUdadmJuUXRabUZ0YVd4NU9pQnpZVzV6TFhObGNtbG1PeUJtYjI1MExYTnBlbVU2SURFeWNIZzdJSDA4TDNOMGVXeGxQangwWlhoMElIZzlJalV3SlNJZ2VUMGlOVEFsSWlCa2IyMXBibUZ1ZEMxaVlYTmxiR2x1WlQwaWJXbGtaR3hsSWlCMFpYaDBMV0Z1WTJodmNqMGliV2xrWkd4bElqNDhkSE53WVc0Z2VEMGlOVEFsSWlCa2VUMGlNakFpUGxSb2FYTWdhWE1nYVc1MllXeHBaQ0JpYVc4dVBDQkJibWRzWlNCaWNtRmphMlYwSUhkcGJHdzhMM1J6Y0dGdVBqeDBjM0JoYmlCNFBTSTFNQ1VpSUdSNVBTSXlNQ0krSUdKeVpXRnJJRk5XUnk0OEwzUnpjR0Z1UGp3dmRHVjRkRDQ4TDNOMlp6ND0ifQ==

Below is SVG parsed out of above tokenUri,

<svg xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="xMinYMin meet" viewBox="0 0 400 100">
    <style>
        text {
            font-family: sans-serif;
            font-size: 12px;
        }
    </style><text x="50%" y="50%" dominant-baseline="middle" text-anchor="middle">
        <tspan x="50%" dy="20">This is invalid bio.< Angle bracket will</tspan>
                <tspan x="50%" dy="20"> break SVG.</tspan>
    </text>
</svg>

Above SVG is invalid and only render part of text which is before opening angle bracket <

https://gyazo.com/eae7acb7b21dda9c6d5e88ad3a747866

Tools Used

Manual

Recommended Mitigation Steps

Consider checking for invalid characters in string bio during call to mint().