tokenURI concatenates unbounded or user-influenced strings (baseURI set by anyone, or on-chain user data) without sanitisation, enabling metadata spoofing or oversized returns for integrators.
// if setBaseURI is unprotected, anyone points metadata at a phishing // host; marketplaces render the attacker's image/name for your NFT.
// restrict baseURI to owner; validate/escape any on-chain string data
function setBaseURI(string calldata u) external onlyOwner { baseURI = u; }
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0215 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.