First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

The function `OneShot.getRapperStats(_tokenId)` returns inconsistent information.

azanux

[L1]: The function OneShot.getRapperStats(_tokenId) returns inconsistent information.

Summary

The function OneShot.getRapperStats(_tokenId) does not check if the tokenId exists.

Vulnerability Details

When we call the function OneShot.getRapperStats(_tokenId) with an NFT tokenId, it doesn't verify whether the tokenId has been minted. Therefore, it returns inconsistent information if the tokenId does not exist. If a user burns their token, they could potentially use the stats of the burned token to engage in battles.

Impact

The statistical information returned is incorrect if the tokenId doesn't exist.

Tools Used

Manual review.

Recommendations

Check if the token exists before returning the statistics.

function getRapperStats(uint256 tokenId) public view returns (RapperStats memory) {
+ require(_ownerOf(tokenId) != address(0), "Token does not exist."); // Ensure the token exists
return rapperStats[tokenId];
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!