First Flight #7: Horse Store

Summary

Calling isHappyHorse for an inexistent horseId returns false, as it would exist.

Vulnerability Details

isHappyHorse can be called for an inexistent horseId and returns false giving the false impression that the horse NFT exists.

Impact

Low - one could mistype the ID and would then feed his horse although that would not be necessary.

Tools Used

Manual review

Recommendations

Revert with a meaningful error if the horse Id does not exist.
if (horseId >= totalSupply()) {
revert MissingHorseId();
}