tokenURI(uint256) function on SmartVaultManager does not comply ERC721 - Metadata specification
Summary
According to the standard, the tokenURI method must be reverted if a non-existent tokenId is passed. In Smart Vault Manager contract that is not the case but it relies on external contracts. This is a violation of the erc721 spec.
Vulnerability Details
tokenUri(uint256) method should implement a check to see if the passed nft id exists. Not checking this on the smart vault manager contract but rather relying on external contracts can lead to unexpected behavior.
Impact
In the worst case scenario, due to some mishap or bug, a non existing nft would have metadata generated as if it existed.
Tools Used
Manual review
Recommendations
Add a nft id exists checker to the contract method.
Lead Judging Commences
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.