NFT Security Testing

// Vulnerable NFT contract with centralized metadata
contract VulnerableNFT is ERC721 {
    // Base URI points to a centralized server
    string private _baseTokenURI = "https://api.example.com/metadata/";
    
    constructor() ERC721("VulnerableNFT", "VNFT") {}
    
    function mint(address to, uint256 tokenId) public {
        _mint(to, tokenId);
    }
    
    function _baseURI() internal view override returns (string memory) {
        return _baseTokenURI;
    }
    
    // Owner can change the base URI at any time
    function setBaseURI(string memory newBaseURI) public onlyOwner {
        _baseTokenURI = newBaseURI;
    }
}

// Improved NFT contract with decentralized metadata
contract SecureNFT is ERC721 {
    // IPFS URI for decentralized storage
    string private _baseTokenURI = "ipfs://QmXyZ...";
    
    // Mapping to store if metadata is frozen for a token
    mapping(uint256 => bool) private _frozenMetadata;
    
    // Event for metadata changes
    event MetadataUpdate(uint256 indexed tokenId);
    event BatchMetadataUpdate(uint256 indexed fromTokenId, uint256 indexed toTokenId);
    
    constructor() ERC721("SecureNFT", "SNFT") {}
    
    function mint(address to, uint256 tokenId) public {
        _mint(to, tokenId);
    }
    
    function _baseURI() internal view override returns (string memory) {
        return _baseTokenURI;
    }
    
    // Owner can change the base URI, but emits events for transparency
    function setBaseURI(string memory newBaseURI) public onlyOwner {
        _baseTokenURI = newBaseURI;
        emit BatchMetadataUpdate(1, totalSupply());
    }
    
    // Allow freezing metadata permanently
    function freezeMetadata(uint256 tokenId) public onlyOwner {
        require(_exists(tokenId), "Token does not exist");
        require(!_frozenMetadata[tokenId], "Metadata already frozen");
        
        _frozenMetadata[tokenId] = true;
    }
    
    // Check if metadata is frozen before allowing changes
    function updateTokenMetadata(uint256 tokenId) public onlyOwner {
        require(_exists(tokenId), "Token does not exist");
        require(!_frozenMetadata[tokenId], "Metadata is frozen");
        
        // Update logic here
        emit MetadataUpdate(tokenId);
    }
}