# Bio lines will overflow the buffer for repeated "continuation" characters

Bio.tokenURI line-splitting logic never breaks lines on repeated Unicode continuation bytes, overflowing the 80-byte buffer and reverting tokenURI for a valid minted bio.

- Payout: Contest reward
- Severity: medium
- Program: Canto Identity Subprotocols
- Credited: adriro
- Disclosed: 2023-05-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-canto-identity-findings/issues/122
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-canto-identity%3AM-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:dos vuln:memory-corruption

**Target:** Bio.sol tokenURI line-splitting for on-chain NFT biography text
**Root cause:** The line-splitting loop sets prevByteWasContinuation=true and continues whenever the next/prev character is a zero-width joiner or skin-tone modifier, so a string of only such continuation characters never triggers a line break and keeps appending to the fixed 80-byte bytesLines buffer.
**Steps:**
1. Mint a bio whose text is 21 repetitions of U+1F3FE (bytes `f0 9f 8f be`), a valid UTF-8 string.
2. Call `bio.tokenURI(1)`.
3. Observe the loop never resets bytesLines because each character matches the skin-tone modifier check, so bytesOffset exceeds 80 and the write reverts (index out of bounds).
**How found:** Reading the line-splitting code, noticed the continuation-character branches `continue` without ever flushing the buffer, hypothesized a string composed solely of such characters would never break, and tested with 21 repeated U+1F3FE codepoints.
**Exploitation:** Any user can mint a bio containing repeated skin-tone modifier or ZWJ codepoints; tokenURI then reverts permanently for that token, breaking metadata rendering. No value extraction.
**Insight:** When a formatter has special-case 'don't split here' branches, test inputs made entirely of the exempt characters — the buffer-flush path may never execute, overflowing fixed-size accumulators.