PositionTokens violates one of the MUST rules defined in EIP-1155
| Title | PositionTokens violates one of the MUST rules defined in EIP-1155 |
|---|---|
| Reward | $720, 5 dups |
| Contest | Index Fun Order Book - 14 Oct 2025 on Sherlock |
| Author | typicalHuman |
| Context | EIP-1155 compliance |
PositionTokens violates one of the MUST rules defined in EIP-1155.
The rule states:
However, in the current implementation, the URI is set to an empty string, violating this requirement.
Alpha: on Sherlock this does not always apply, and it may be judged low. Read the README to make sure, as in this contest.
Additionally, the sponsor’s README explicitly states that violations of MUST EIP rules should be considered medium severity issues.
Conclusion
$720 for this finding is very good value, but always read the README! It has to say something like this:
Is the codebase expected to comply with any specific EIPs?
We use EIP-712 for signature validation in the Market Controller -> _verifyOrder
We use EIP-1155 for Conditional Tokens
We use EIP 1967 Upgradable Proxy
If there are issues violating “MUST” statements from these EIP, they can be considered Medium severity. The reports must show the impact that the non-compliance can lead to, besides just stating where the non-compliance is.