Skip to content
medium Token Standards No SWC entry CWE-129

ERC1155 Batch Length Mismatch

SAFE-0212 Token Standards Checked automatically by the scanner
1

What goes wrong

A batch operation iterates ids and amounts arrays without requiring ids.length == amounts.length. A caller can pass mismatched arrays to mint/transfer wrong quantities or read out of the intended range.

2

The vulnerable pattern

proof of concept — how it is exploited
// mintBatch([1,2,3], [100]) - loop uses ids.length=3
// amounts[1], amounts[2] read past the array (0 or revert)
// depending on layout -> inconsistent mint.
3

How to fix it

the pattern that is safe
require(ids.length == amounts.length, "length mismatch");
◆
Enforce equal lengths on every paired-array batch op.
4

Related vulnerabilities in Token Standards

SAFE-0053Unsafe / Unprotected Minting critical · Token Standards SAFE-0051Missing SafeERC20 / Non-Standard Token Handling high · Token Standards SAFE-0052Fee-on-Transfer / Rebasing Token Accounting Mismatch high · Token Standards SAFE-0055Burn Authorization / Burn-From Missing Checks high · Token Standards SAFE-0107Fee-on-Transfer / Rebasing Token Mis-Accounting high · Token Standards SAFE-0208Non-Standard ERC20 Return Value Not Handled high · Token Standards SAFE-0050ERC-20 Approval Race Condition medium · Token Standards SAFE-0054ERC-721/1155 Missing Receiver Validation (Safe Transfer) medium · Token Standards
← PreviousState Updated Before Transfer Success Confirmed
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0212 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs