Submission Details
Severity:
`tokenURI()` does not follow ERC721 standards
Summary & Vulnerability Details
As per eip-721, the standard to be followed for ERC721, function tokenURI() should revert if the tokenId is an invalid NFT. However, that is not the case here.
See an example of a similar bug raised here.
Impact
SantasList does not conform to ERC721 standards and users or external protocols making use of it can be misled into believing that the results they get on calling various functions are as per standards, which may lead to incorrect results.
Tools Used
Manual inspection
Recommendations
Make modifications on the following lines:
- function tokenURI(uint256 /* tokenId */ ) public pure override returns (string memory) {
+ function tokenURI(uint256 tokenId) public pure override returns (string memory) {
+ if (ownerOf[tokenId] == address(0))
+ // According to ERC721, this revert for invalid NFTs is required
+ revert ERC721NonexistentToken(tokenId);
return TOKEN_URI;
}
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.