Submission Details
Severity:
The `tokenURI` function does not check if the `_tokenId` has been minted
Summary
The tokenURI function does not check if the _tokenId has been minted. Thus breaks the EIP721 spec.
Vulnerability Details
In SmartVaultManagerV5.sol we have tokenURI():
function tokenURI(uint256 _tokenId) public view virtual override returns (string memory) {
ISmartVault.Status memory vaultStatus = ISmartVault(smartVaultIndex.getVaultAddress(_tokenId)).status();
return INFTMetadataGenerator(nftMetadataGenerator).generateNFTMetadata(_tokenId, vaultStatus);
}
This function returns unique URI for each token (NFT) based on its tokenId.
According to the standard, the tokenURI method must revert if a non-existent tokenId is passed.
Impact
tokenURI() is not compliant with EIP721
Tools Used
Visual Studio Code
Recommendations
Add a _tokenId existence check in tokenURI().
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.