DittoETH

Summary

The ownerOf() function does not properly verify token ownership.

Vulnerability Details

ownerOf() calls _ownerOf() which simply returns the mapped owner address. It does not verify that the token actually exists first.

This could allow ownerOf() to return a non-zero owner for a non-existent token ID.

Impact

Makes it appear tokens are owned when they are not actually minted.

Could disrupt systems relying on ownerOf() checks.

Tools Used

Manual

Recommendations

Call _exists() first in ownerOf() to properly validate.