Submission Details
Severity:
Getters does not revert for non-existent values
Description
The provided functions return default values for non-existent token IDs because they do not check if the token ID exists before accessing its information.
function tokenURI(
uint256 tokenId
) public view override returns (string memory) {
@>
CatInfo memory catInfo = s_catInfo[tokenId];
string memory catTokenUri = Base64.encode(
abi.encodePacked(
'{"name": "',
catInfo.catName,
'", "breed": "',
catInfo.breed,
'", "image": "',
catInfo.image,
'", "dob": ',
Strings.toString(catInfo.dob),
', "owner": "',
@> Strings.toHexString(_ownerOf(tokenId)),
'", "shopPartner": "',
Strings.toHexString(catInfo.shopPartner),
'"}'
)
);
return string.concat(_baseURI(), catTokenUri);
}
function getCatAge(uint256 tokenId) external view returns (uint256) {
@>
return block.timestamp - s_catInfo[tokenId].dob;
}
function getCatInfo(
uint256 tokenId
) external view returns (CatInfo memory) {
@>
return s_catInfo[tokenId];
}
Risk
Likelyhood: Low
Occurs for any call with a non-existent token ID.
Impact: Low
Returns default values instead of reverting. It can lead to confusion of users using these external functions.
Recommended Mitigation
function tokenURI(
uint256 tokenId
) public view override returns (string memory) {
CatInfo memory catInfo = s_catInfo[tokenId];
string memory catTokenUri = Base64.encode(
abi.encodePacked(
'{"name": "',
catInfo.catName,
'", "breed": "',
catInfo.breed,
'", "image": "',
catInfo.image,
'", "dob": ',
Strings.toString(catInfo.dob),
', "owner": "',
- Strings.toHexString(_ownerOf(tokenId)),
+ Strings.toHexString(ownerOf(tokenId)),
'", "shopPartner": "',
Strings.toHexString(catInfo.shopPartner),
'"}'
)
);
return string.concat(_baseURI(), catTokenUri);
}
function getCatAge(uint256 tokenId) external view returns (uint256) {
+ require(_exists(tokenId));
return block.timestamp - s_catInfo[tokenId].dob;
}
function getCatInfo(
uint256 tokenId
) external view returns (CatInfo memory) {
+ require(_exists(tokenId));
return s_catInfo[tokenId];
}
Rewards breakdown
nSLOC
235This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.