Submitted by horsefacts
CidNFT#tokenURI does not convert the uint256 _id argument to a string before interpolating it in the token URI:
This means the raw bytes of the 32-byte ABI encoded integer _id will be interpolated into the token URI, e.g. 0x0000000000000000000000000000000000000000000000000000000000000001 for ID #1.
Most of the resulting UTF-8 strings will be malformed, incorrect, or invalid URIs. For example, token ID #1 will show up as the invisible start of heading control character, and ID #42 will show as the asterisk symbol *. URI-unsafe characters will break the token URIs altogether.
Convert the _id to a string before calling abi.encodePacked. Latest Solmate includes a LibString helper library for this purpose:
OpenCoreCH (Canto Identity) confirmed and commented:
For this contest, 23 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by HardlyDifficult received the top score from the judge.
The following wardens also submitted reports: d3e4, JC, libratus, joestakey, adriro, Aymen0909, enckrish, 0xAgro, sorrynotsorry, SleepingBugs, merlin, DevABDee, Matin, shark, 0xSmartContract, rotcivegaf, Rolezn, brevis, btk, nicobevi, hihen, and chaduke.
