Submission Details
Severity:
RAACNFT getHousePrice will return 0 for non existing tokenId
Summary
Non existing tokenId will return a price of 0
Vulnerability Details
the openzeppelin ERC721 contract requires NFT to be owned, thus minted, to return a tokenURI or it will revert with a ERC721NonexistentToken.
RAACNFT doesn't follow the same logic and every not minted token will return a price of 0 in getHousePrice instead of reverting following the same logic as ERC721.
function getHousePrice(uint256 _tokenId) public view override returns(uint256) {
// @audit should revert if price is 0 or if token not owned following tokenURI from ERC721
return raac_hp.tokenToHousePrice(_tokenId);
}
Impact
It will return a price of 0 while for non existing NFTs while it should not return any price. It is a low impact.
Likelihood is high as it will always happen
Recommendations
Add the same check as ERC721 contract
function getHousePrice(uint256 _tokenId) public view override returns(uint256) {
+ _requireOwned(tokenId);
return raac_hp.tokenToHousePrice(_tokenId);
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.