[H-3] BatchMetadata modules may apply baseURI to incorrect token ids

thirdweb-dev · Sep 28, 2024 · 6edc471 · 6edc471
1 parent a58c573
commit 6edc471
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 7 deletions.
diff --git a/src/module/token/metadata/BatchMetadataERC1155.sol b/src/module/token/metadata/BatchMetadataERC1155.sol
@@ -44,7 +44,7 @@ contract BatchMetadataERC1155 is BatchMetadataERC721, UpdateMetadataCallbackERC1
         if (_startTokenId < _batchMetadataStorage().nextTokenIdRangeStart) {
             revert BatchMetadataMetadataAlreadySet();
         }
-        _setMetadata(_quantity, _baseURI);
+        _setMetadata(_startTokenId, _quantity, _baseURI);
     }
 
 }
diff --git a/src/module/token/metadata/BatchMetadataERC721.sol b/src/module/token/metadata/BatchMetadataERC721.sol
@@ -121,7 +121,7 @@ contract BatchMetadataERC721 is Module, UpdateMetadataCallbackERC721 {
         if (_startTokenId < _batchMetadataStorage().nextTokenIdRangeStart) {
             revert BatchMetadataMetadataAlreadySet();
         }
-        _setMetadata(_quantity, _baseURI);
+        _setMetadata(_startTokenId, _quantity, _baseURI);
     }
 
     /*//////////////////////////////////////////////////////////////
@@ -150,7 +150,7 @@ contract BatchMetadataERC721 is Module, UpdateMetadataCallbackERC721 {
 
     /// @notice Uploads metadata for a range of tokenIds.
     function uploadMetadata(uint256 _amount, string calldata _baseURI) external virtual {
-        _setMetadata(_amount, _baseURI);
+        _setMetadata(_batchMetadataStorage().nextTokenIdRangeStart, _amount, _baseURI);
     }
 
     function nextTokenIdToMint() external view returns (uint256) {
@@ -219,19 +219,18 @@ contract BatchMetadataERC721 is Module, UpdateMetadataCallbackERC721 {
     }
 
     /// @notice sets the metadata for a range of tokenIds.
-    function _setMetadata(uint256 _amount, string calldata _baseURI) internal virtual {
+    function _setMetadata(uint256 _rangeStart, uint256 _amount, string calldata _baseURI) internal virtual {
         if (_amount == 0) {
             revert BatchMetadataZeroAmount();
         }
 
-        uint256 rangeStart = _batchMetadataStorage().nextTokenIdRangeStart;
-        uint256 rangeEndNonInclusive = rangeStart + _amount;
+        uint256 rangeEndNonInclusive = _rangeStart + _amount;
 
         _batchMetadataStorage().nextTokenIdRangeStart = rangeEndNonInclusive;
         _batchMetadataStorage().tokenIdRangeEnd.push(rangeEndNonInclusive);
         _batchMetadataStorage().baseURIOfTokenIdRange[rangeEndNonInclusive] = _baseURI;
 
-        emit BatchMetadataUpdate(rangeStart, rangeEndNonInclusive - 1);
+        emit BatchMetadataUpdate(_rangeStart, rangeEndNonInclusive - 1);
     }
 
     function _batchMetadataStorage() internal pure returns (BatchMetadataStorage.Data storage) {