Coinbase

Coinbase: tokenize PR 105

Cantina Security Report

Organization

@coinbase

Engagement Type

Cantina Reviews

Period

-

Researchers

Sujith S

0xhuy0512

Findings

Informational

3 findings

1 fixed

2 acknowledged

Informational3 findings

  1. Global mintId namespace allows cross-token key consumption

    State

    Acknowledged

    Severity

    Severity: Informational

    Submitted by

    Sujith S

    Description

    usedCreateIds is shared globally across every registered token and caller. A whitelisted caller can consume an ID that another token’s caller intended to use. This is informational because create() is only exposed to trusted whitelisted callers.

    Recommendation

    Document the global trust assumption, if its intended.

    Coinbase: Acknowledged.

    Cantina: Acknowledged.

  2. Empty mint IDs are accepted

    State

    Acknowledged

    Severity

    Severity: Informational

    Submitted by

    Sujith S

    Description

    create() does not validate that mintId contains any data. The first call using "" as mintId succeeds and consumes the global empty-string key.

    Recommendation

    Reject empty IDs with if (bytes(mintId).length == 0) revert InvalidMintId();

    Coinbase: Acknowledged. There is no on-chain schema so these values will be opaque to the contract itself.

    Cantina: Acknowledged.

  3. No view function is available to query consumed mint IDs

    State

    Fixed

    https://github.com/coinbase/tokenize/pull/105/changes/d809323ced92cbb7542d57d1c5f49ee6374e92b7

    Severity

    Severity: Informational

    Submitted by

    Sujith S

    Description

    usedCreateIds is stored privately without an external getter. Integrations must scan Created logs or attempt a mint and handle DuplicateCreateId.

    Recommendation

    Consider adding a view function: isCreateIdUsed(string calldata mintId) external view returns (bool)

    Coinbase: Fixed in d809323

    Cantina: Verified fix.