Predictable Token ID Generation in the UninversalNFT contract

[0xM3R]

Vulnerability Details

The safeMint function in the UniversalNFT smart contract generates token IDs using predictable inputs, such as block.number, address(this), and an incrementing counter. This predictability exposes the contract to front-running attacks, where malicious actors could exploit the ability to anticipate token IDs.

Analysis

The vulnerability lies in the following lines

standard-contracts/contracts/nft/contracts/evm/UniversalNFT.sol

Line 55 in a08166a

uint256 tokenId = hash & 0x00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF;

:

uint256 hash = uint256(
    keccak256(
        abi.encodePacked(address(this), block.number, _nextTokenId++)
    )
);
uint256 tokenId = hash & 0x00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF;

How it Can Be Harmful:

• Front-Running Attacks: Attackers can monitor the blockchain for minting transactions and exploit predictable token IDs to acquire specific tokens, potentially with valuable attributes or metadata.

• Manipulation Risks: Miners can influence block.number to skew token ID outcomes in their favor.

How to Mitigate the Issue

1. Incorporate Secure Randomness: Use a reliable randomness source, such as Chainlink VRF:
solidity.

uint256 tokenId = uint256(keccak256(abi.encodePacked(requestId)));

2. Delayed Metadata Reveal: Implement a delayed reveal mechanism to obfuscate the token’s attributes until after minting is complete.

3. Use more secure source of randomness: For example, the timestamp can be used to add more reliability to the token id generation.

uint256 tokenId = uint256(
    keccak256(
        abi.encodePacked(blockhash(block.number - 1), block.timestamp, _nextTokenId++)
    )
) & 0x00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF;

References

• Ethereum Smart Contract Security Best Practices: SWC-120: Weak Sources of Randomness https://swcregistry.io/docs/SWC-120/
• Chainlink VRF Documentation: Chainlink VRF for Secure Randomness https://docs.chain.link/vrf/v2/security
• ERC721R: A new ERC721 contract for random minting so people don’t snipe all the rares! https://medium.com/@dumbnamenumbers/erc721r-a-new-erc721-contract-for-random-minting-so-people-dont-snipe-all-the-rares-68dd06611e5