registry / @gluwa/gluwa-nft / 0.1.28

@gluwa/gluwa-nft@0.1.28

Gluwa NFT contracts, including GluwaNFTBase

AI Security Review

scanned 9h ago · by lpm-firewall-ai

The deployed `SupportFunctions` contract has unrestricted metadata and royalty setters. A configured GluwaNFT instance delegates metadata reads to that contract, so any caller can overwrite those values.

Static reason

No blocking static signals were detected.

Trigger

Any on-chain caller invokes public setters on a deployed configured `SupportFunctions` instance.

Impact

NFT contract metadata can be altered and secondary-sale royalty payments can be redirected or changed.

Mechanism

Unprotected external metadata and royalty mutation.

Rationale

The package is not malicious in the npm supply-chain sense, but it ships a concrete access-control flaw that can redirect royalties in deployed integrations. Flag as warn rather than block because no stealth execution, lifecycle abuse, or malicious payload behavior is present.

Evidence

package.jsoncontracts/SupportFunctions.solcontracts/SeadropCloneable/ERC721ContractMetadataCloneable.solcontracts/GluwaNFT.solcontracts/abstracts/AdminUpgradeable.solcontracts/test/utils/console.sol

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.

@gluwa/gluwa-nft@0.1.28

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code