onflow / freshmint

Apache License 2.0
68 stars 17 forks source link

Preventing metadata hash collisions #136

Closed psiemens closed 1 year ago

psiemens commented 2 years ago

The current NFT metadata serialization scheme is prone to duplicate encodings (and therefore duplicate hashes) when used with arbitrary-length values (e.g. strings).

For example:

"foo".concat("bar) == "foob".concat("ar")

In this case inputs are distinct but the concatenation is the same.

psiemens commented 2 years ago

To solve this, I am likely going to add a constant-length size prefix to the following types:

The remaining fields types (e.g. UInt64, etc) have a constant-length encoding.