The tokenURI
function checks ownerOf(tokenId) == address(0)
to validate token existence. However, ERC721’s ownerOf
already reverts for non-existent tokens, making this check unreachable.
The custom error ERC721Metadata__URI_QueryFor_NonExistentToken
is never thrown. Queries for non-existent tokens revert with the default ERC721 error instead.
Replace the ownerOf
check with the ERC721 _exists
function.
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.