Description:Description\
Having a sinle step owner only methods are always dangerous.
But when it comes to NFTS, it is majorly about the art that the nft pwns/.
However , what if the underlying art has been changed suddenly by the token owner . If the art is changed to something really ridiculous image , then the nfts will be worthless. This is the constant fear that the stakingpPositionManger NFT holders will have. It arises from the fact that the setBaseURI function which is highly dangerous to completely change the underlying art folder of the NFT project is totally owner controlled.
Although the likelihood is low but the impact is really high because if it happens, then the users of the NFTs will lose their value if the market values the attached art more than the nft itself.
Some embraced the new NFTs, while others accused Truth Labs of "rugging". Some people were horrified by the fact that NFTs that they owned could be changed after the fact without their consent, a fact they were not previously aware of. One owner wrote, "So your telling me I spent $1,000s of dollars and have 10 goblintowns for them all to now be dudes shaking their weiners?"
Although it might not a have serious issues in staking nfts this might still pose significant risk on the token holder's minds if the attached art is important to them.
Attack Scenario\
Owner of stakingPositionManager will call the setBaseURI function with any
arbitrary art folder and do it in a single transaction.
Revised Code File (Optional)
Allow two step change of base URI and have a timelock of at least 2 to 3 days so that users are aware of this change and they can make their investment decisions whether to keep the NFTs or sell them.
PlamenTSV
commented
7 months ago
Github username: @0xumarkhatab Twitter username: 0xumarkhatab Submission hash (on-chain): 0x2a136b898d08571e19603ff3835c8f2a934a3a8945d8e7f706967adb20f8f237 Severity: medium
Description: Description\ Having a sinle step owner only methods are always dangerous. But when it comes to NFTS, it is majorly about the art that the nft pwns/. However , what if the underlying art has been changed suddenly by the token owner . If the art is changed to something really ridiculous image , then the nfts will be worthless. This is the constant fear that the stakingpPositionManger NFT holders will have. It arises from the fact that the setBaseURI function which is highly dangerous to completely change the underlying art folder of the NFT project is totally owner controlled.
Although the likelihood is low but the impact is really high because if it happens, then the users of the NFTs will lose their value if the market values the attached art more than the nft itself.
This has happened with the Truth Labs tokens holders where they have changed their base URI to a ridiculous image making the holders feel "being rugged". https://www.web3isgoinggreat.com/single/goblintown-nft-images-all-changed-to-an-illustrated-middle-finger-in-protest-about-royalties
Although it might not a have serious issues in staking nfts this might still pose significant risk on the token holder's minds if the attached art is important to them.
Attack Scenario\ Owner of stakingPositionManager will call the setBaseURI function with any arbitrary art folder and do it in a single transaction.
Attachments N/A
Proof of Concept (PoC) File N/A
Revised Code File (Optional) Allow two step change of base URI and have a timelock of at least 2 to 3 days so that users are aware of this change and they can make their investment decisions whether to keep the NFTs or sell them.