## Detailed Description The `Banny721TokenUriResolver `contract implements a sophisticated system for managing NFT metadata and SVG content through a two-step verification process. This analysis explores how this system, while secure against unauthorized actors, presents interesting attack possibilities when owner privileges are involved. At the heart of the system is a dual-control mechanism: ```solidity function setSvgHashsOf(uint256[] memory upcs, bytes32[] memory svgHashs) external override onlyOwner function setSvgContentsOf(uint256[] memory upcs, string[] calldata svgContents) external override ``` The owner must first register content hashes, creating a controlled gateway for all SVG content entering the system. Once a hash is registered, anyone can provide matching content, but the strict hash verification ensures only pre-approved content makes it into the system. A malicious owner or compromised owner account could register hashes for SVGs containing harmful JavaScript like the one below: ```js ``` The attack becomes particularly potent through the decoration system. When users decorate their Bannys with infected worlds or outfits, the malicious content spreads through normal NFT interactions. Each view of an infected NFT's metadata triggers the payload in the context of NFT marketplaces and wallets. While the contract successfully prevents unauthorized content injection, it places significant trust in the owner's content approval process. A compromised owner or a malicious actor with access to the owner account could exploit this trust to spread malicious content. The viral potential through NFT decoration and trading makes this a high-impact vulnerability even though the likelyhood is Low despite its privileged access requirement. A single compromised hash registration could affect thousands of users through normal marketplace interactions. This case demonstrates how traditional web2 vulnerabilities find their way into the blockchain systems, even with strong access controls. This finding suggest implementing additional safeguards around hash registration: 1. Multi-signature requirements for hash registration 2. Timelock delays on hash updates 3. Content verification before hash registration This vulnerability represents a sophisticated intersection of privileged access, content delivery, and NFT composability, creating a unique attack surface. **Attack Path** 1. Initial Setup ```solidity function setSvgHashsOf(uint256[] memory upcs, bytes32[] memory svgHashs) external override onlyOwner { for (uint256 i; i < upcs.length; i++) { uint256 upc = upcs[i]; bytes32 svgHash = svgHashs[i]; svgHashOf[upc] = svgHash; } } ``` The attack first needs the contract owner to register SVG hashes for specific UPCs (Universal Product Codes). 2. Content Injection ```solidity function setSvgContentsOf(uint256[] memory upcs, string[] calldata svgContents) external override { for (uint256 i; i < upcs.length; i++) { uint256 upc = upcs[i]; string memory svgContent = svgContents[i]; if (keccak256(abi.encodePacked(svgContent)) != svgHash) revert Banny721TokenUriResolver_ContentsMismatch(); _svgContentOf[upc] = svgContent; } } ``` Once hashes are registered, any user can upload SVG content matching those hashes. The contract only verifies hash matching but performs no content sanitization. 3. Payload Delivery ```solidity function tokenUriOf(address hook, uint256 tokenId) external view override returns (string memory) { // ... contents = _svgOf({hook: hook, upc: product.id}); // ... return string.concat( "data:application/json;base64,", Base64.encode( abi.encodePacked( // ... metadata including SVG content ) ) ); } ``` The malicious SVG is served through the `tokenURI`, which is rendered by NFT marketplaces and wallets. **Attack Implementation** Hash Registration ```solidity uint256[] memory worldIds = new uint256[](1); worldIds[0] = 1; bytes32[] memory svgHashes = new bytes32[](1); svgHashes[0] = keccak256(bytes(maliciousSvg)); resolver.setSvgHashsOf(worldIds, svgHashes); ``` Payload Injection ```solidity string memory maliciousSvg = string( abi.encodePacked( '

Contest	Position	Date	Payout
infinitypools	7 / 396	September 2024	$7,644
TermMax	3 / 255	February 2025	$3,509
juicebox-monorepo	6 / 262	December 2024	$1,472
sorella-angstrom	13 / 306	November 2024	$650
spend-permissions	3 / 355	October 2024	$625

0xtincion

Top competitions