# PositionTokens violates one of the MUST rules defined in EIP-1155

Bug Deep Dive #2 · 28 November 2025

Bug Deep Dives · [The Contest Academy](https://0xsimao.com/the-contest-academy) · 0xSimao

---

| Title | PositionTokens violates one of the MUST rules defined in EIP-1155 |
| Reward | $720, 5 dups |
| Contest | Index Fun Order Book - 14 Oct 2025 on Sherlock |
| Author | typicalHuman |
| Context | EIP-1155 compliance |

PositionTokens violates one of the MUST rules defined in [EIP-1155](https://eips.ethereum.org/EIPS/eip-1155#:~:text=in%20RFC%203986.-,The%20URI%20MUST%20point%20to%20a%20JSON%20file%20that%20conforms%20to%20the%20%22ERC%2D1155%20Metadata%20URI%20JSON%20Schema%22.,-%40return%20URI%20string).\
The rule states:

However, in the current implementation, the URI is set to an empty string, violating this requirement.\
\
**Alpha:** on Sherlock this does not always apply, and it may be judged low. Read the README to make sure, as in this contest.\
\
Additionally, the sponsor’s README explicitly states that violations of MUST EIP rules should be considered medium severity issues.

**Conclusion**

**\$720** for this finding is very good value, but always read the README! It has to say something like this:

> **Is the codebase expected to comply with any specific EIPs?**
> We use EIP-712 for signature validation in the Market Controller -> _verifyOrder
> We use EIP-1155 for Conditional Tokens
> We use EIP 1967 Upgradable Proxy
> If there are issues violating “MUST” statements from these EIP, they can be considered Medium severity. The reports must show the impact that the non-compliance can lead to, besides just stating where the non-compliance is.

[**Full Report**](https://audits.sherlock.xyz/contests/1197/report)

---

Newer: [Lack of Emergency Market Invalidation Mechanism](https://0xsimao.com/the-contest-academy/bug-deep-dive-3) · Older: [Asymmetric fee structure allows market participants to get the same outcome for less fee](https://0xsimao.com/the-contest-academy/bug-deep-dive-1)