code-423n4 / 2022-01-xdefi-findings

0 stars 0 forks source link

Public function that could be set external instead #160

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

Jujic

Vulnerability details

Impact

The tokenURI() could be set external instead of public.

Proof of Concept

https://github.com/XDeFi-tech/xdefi-distribution/blob/3856a42df295183b40c6eee89307308f196612fe/contracts/XDEFIDistribution.sol#L231

Tools Used

Remix

Recommended Mitigation Steps

deluca-mike commented 2 years ago

tokenURI cannot be made external since it's inherited from the standard ERC721 interface where it defined as public, and thus cannot be overridden and changed. Slither doesn't take this into account.