Summary

The tokenURI view returns the URI of common rarity NFTs when queried about non-existing items.

Vulnerability Details

Passing the token_id of a non-existing NFT to the tokenURI view returns the URI of a common rarity item, instead of failing and throwing.
The following test can be added to the test suite to assess the wrong behavior:

Impact

This behavior can lead to confusion and poor integration, as tokens that do not exist will be associated to common rarity, even if, when minted, they could actually be different.

Tools Used

Manual review, VSCode, Pytest

Recommendations

Querying the URI of non-existing NFTs should fail, avoiding the confusing return value of common rarity.