LOCOZExtension Manual Review Findings

LOO-01M: Weak Access Control

Description:

The access control imposed on setBaseURI appears to be weak as any minter is able to adjust the _uri, a sensitive variable that can be exploited for web-based attacks such as XSS.

Example:

Copy
21function setBaseURI(string memory uri) public onlyMinter {
22    _uri = uri;
23    emit BaseURISet(uri);
24}

Recommendation:

We advise the setBaseURI function to instead be invoke-able only by the administrator of the AccessControl contract.

Alleviation:

The setBaseURI function now properly ensures that only the DEFAULT_ADMIN_ROLE can invoke it by enforcing the onlyRole modifier.